DOJ Settles Honeywell Aerospace Cybersecurity Claims for More Than $2 Million

The U.S. Department of Justice (DOJ) reached a settlement with Honeywell Aerospace valued at more than $2 million over allegations that cybersecurity requirements were not met on a network handling U.S. Department of Defense (DoD) information. The reported period runs from April 2020 through December 2023. The available report describes allegations and a settlement; it does not state that a data breach occurred. For contractors, the case underscores that cybersecurity exposure can arise from the accuracy of compliance representations, not only from a confirmed compromise or operational incident.

The procurement significance is the connection between cybersecurity controls, compliance records, and representations made to the government. Contractors supporting defense programs may need to substantiate applicable National Institute of Standards and Technology (NIST) and Defense Federal Acquisition Regulation Supplement (DFARS) assertions, as well as related Supplier Performance Risk System (SPRS) scores and remediation disclosures. The signal specifically calls for validation across all relevant networks and for approval controls that ensure submissions are supported by records. A cybersecurity certification should therefore be treated as a contract-compliance assertion requiring evidence and cross-functional review—not simply as an IT sign-off.

The report also notes that CMMC self-assessment requirements were delayed for at least 60 days in July 2026, but provides no revised effective date. That date should be understood as a reported delay, not as a definitive current or future compliance deadline. Contractors should avoid inferring a new implementation date from the delay alone and should monitor authoritative agency updates. In the meantime, the settlement provides a practical reason to review existing cybersecurity representations and supporting documentation without relying on an assumed CMMC timetable.

The source quotes Michael Volkov, CEO of The Volkov Law Group, emphasizing that cybersecurity compliance should involve the broader organization: “Not just having IT sitting at the table, or your CISO sitting at the table, I want to have compliance, business, everybody at the table.” For GovCon teams, that means involving technical, compliance, contracts, legal, and business stakeholders in the preparation and approval of government-facing assertions. A coordinated review can help identify gaps between documented controls, actual network environments, remediation status, and the statements submitted to the government. The reported settlement does not establish that every contractor will face the same outcome, but it illustrates why evidence, governance, and review processes matter throughout contract performance.

• DOJ settlement: The agreement with Honeywell Aerospace is valued at more than $2 million and concerns allegations that cybersecurity requirements were not met.
• Relevant period: The network at issue reportedly handled DoD information from April 2020 to December 2023.
• No breach stated: The report presents the matter as an example of potential cybersecurity liability tied to inaccurate compliance certifications even when no breach is reported.
• Review representations: Validate applicable NIST- and DFARS-related representations before submission to the government.
• Check SPRS and remediation records: Confirm SPRS scores, remediation disclosures, and supporting evidence are accurate and current.
• Map networks and approvals: Review all relevant networks and ensure approval controls cover the scope of each cybersecurity assertion.
• Use cross-functional governance: Include IT and the CISO alongside compliance, business, contracts, and other relevant teams in the review process.
• Treat CMMC timing cautiously: The reported July 2026 delay was for at least 60 days; the available information provides no revised effective date, so do not treat it as a new deadline.