Defense and aerospace companies ILC Dover LP and ILC Astrospace LLC have agreed to pay $13 million to settle allegations that they failed to comply with cybersecurity requirements in federal contracts. The Justice Department announced the resolution November 3, saying the claims remain allegations and there has been no determination of liability.
What the government alleged
DOJ says the companies submitted false or fraudulent claims for payment on contracts with the Army, Missile Defense Agency and NASA from January 2018 to October 2024. The government alleges the claims were false because the companies knew they had not complied with the contracts' cybersecurity requirements.
One allegation concerns third-party cloud storage of controlled unclassified information from February 2023 to October 2024. DOJ says the companies did not require and ensure that the cloud provider met security requirements equivalent to the FedRAMP Moderate baseline and complied with specified Defense Department requirements, including cyber-incident reporting and preservation of material for forensic analysis.
Other allegations concern system security plans, implementation of controls in National Institute of Standards and Technology publications, plans to correct deficiencies, and assessments submitted to the Defense Department. The announcement gives different periods for these alleged failures; they are not all alleged to span the entire January 2018–October 2024 interval.
A settlement of claims
The announcement describes contractual requirements and alleged noncompliance. It does not establish that attackers breached the companies' systems or stole government information. The government's description of controls that could prevent exploitation is not a finding that exploitation occurred.
The resolution also covers a False Claims Act whistleblower lawsuit. DOJ says the settlement provides a $2.35 million share of the settlement amount for the whistleblower. That is a share of the $13 million, not an additional penalty.
What remains unverified
The release does not establish that the settlement money has been paid, provide an independently verified account of the companies' current security controls, or identify completed corrective work. The underlying contracts and technical systems were not examined for this report. Agreement to settle the government's claims does not turn the allegations into adjudicated findings.