Honeywell Aerospace Settles $2.04M Cybersecurity Violation with DoD

On September 1, 2026, Honeywell Aerospace Inc. agreed to a $2.04 million settlement with the U.S. Department of Justice (DOJ), following allegations that it failed to comply with the National Institute of Standards and Technology (NIST) SP 800-171 cybersecurity requirements during its contract with the Department of Defense (DoD). This settlement is a pivotal reminder of the ongoing risks that defense contractors face regarding cybersecurity compliance, reflecting heightened scrutiny in federal contracting. The violations in question stem from conduct occurring between April 2020 and December 2023, during which Honeywell allegedly submitted false claims for payments while neglecting necessary cybersecurity measures designed to protect sensitive defense information.

The allegations arose from a qui tam complaint filed in 2022 by a former employee, Rachel Tenney, as part of the False Claims Act (FCA) provisions. The DOJ's intervention not only sheds light on Honeywell's alleged noncompliance but also underscores the imperative for defense contractors to implement robust cybersecurity protocols. With the recent announcement of Honeywell Aerospace becoming a standalone public entity in June 2026, this legal oversight presents significant ramifications as it relates to its reputation and financial stability in the defense contracting space.

In the official announcement, Brett A. Shumate, Assistant Attorney General, emphasized that “contractors that obtain defense information in administering their contracts must follow required cybersecurity standards.” This reaffirms the government’s commitment to enforcing cybersecurity compliance among all contractors handling covered defense information (CDI). The implications are clear: defense contractors must ensure that they are compliant not just to secure future contracts, but also to avoid severe penalties associated with FCA violations.

The fallout from this case illustrates the implications of the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 clause, which is a standard requirement in most DoD contracts. This clause mandates that contractors implementing covered defense information on non-federal systems must provide adequate security—principally by adhering to the 110 controls outlined in NIST SP 800-171. The incident highlights that the government expects rigorous cybersecurity measures, especially in environments with sensitive data at risk.

Even with the postponement of the Cybersecurity Maturity Model Certification (CMMC) Phase II rollout, compliance with existing regulations remains crucial. As the contractor community awaits further guidelines on CMMC, the message from this settlement is clear: contractors cannot afford to let their guard down. The risk of litigation and the potential financial fallout are significant motivators for ensuring proper cybersecurity measures are in place.

This scenario alerts not just the direct contractors, but also subcontractors, to a pressing need for thorough evaluations of their cybersecurity postures. Given the evolving landscape of federal regulations and an increase in compliance enforcement, all parties must review contract clauses to align with the DoD’s requirements and mitigate liabilities. Failure to do so could lead to similar lawsuit risks as seen with Honeywell, thereby affirming the necessity for stringent cybersecurity practices.

• Honeywell Aerospace Inc. agrees to settle for $2.04 million over false claims.
• Allegations span from April 2020 to December 2023, focusing on cybersecurity compliance risks.
• Settlement reflects federal enforcement of the False Claims Act regarding cybersecurity standards.
• Prosecutors emphasized the obligation of contractors to protect defense information securely.
• The DoD's cybersecurity requirements under DFARS 252.204-7012 are still in force despite CMMC delays.
• A whistleblower suit initiated the legal proceedings, showcasing the role of vigilance in federal contracting.
• Honeywell Aerospace became a standalone entity in June 2026, delineating their operational structure.
• Companies must reassess their compliance strategies to meet stringent DoD cybersecurity requirements.