ILC Dover and ILC Astrospace Agree to $13M Cybersecurity Settlement

On November 3, 2026, ILC Dover LP and ILC Astrospace LLC agreed to a $13 million settlement resolving allegations that they failed to satisfy cybersecurity controls required while performing federal contracts. The work supported the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA). The settlement includes $6.5 million designated as restitution. Neither company admitted liability, so the resolution should be understood as settlement of allegations rather than an admission that the companies violated the requirements at issue.

The case carries procurement significance because cybersecurity requirements are not merely technical aspirations: when incorporated into federal contract performance and related representations, they can become material compliance obligations. The reported allegations concern both whether required safeguards were implemented and whether cybersecurity assessments accurately reflected the companies’ systems and practices. For contractors, the implication is direct: documentation, assessment methods, system boundaries, and operational controls need to align. A gap between what a contractor reports and what it actually operates can create substantial legal and financial exposure.

The matter also underscores the need to manage cybersecurity across the supply chain. Contractors relying on third-party cloud providers should understand how those providers’ security practices relate to the government contract’s requirements, and should maintain appropriate oversight and evidence. Outsourcing infrastructure does not necessarily remove a prime or subcontractor’s responsibility to ensure contract obligations are met. Procurement and compliance teams can use this settlement as a prompt to revisit cloud-provider due diligence, contractual flow-downs, monitoring, and escalation processes for identified deficiencies.

A notable feature of the case is that the alleged deficiencies could carry consequences independently of a successful cyberattack or confirmed data theft. As Sotiria Nezi, Special Agent in Charge of the Air Force Office of Special Investigations (AFOSI) Procurement Fraud Detachment 6, stated: “What makes cybersecurity fraud cases particularly important is that the risk is not always visible. A contractor may keep working while the systems holding sensitive government information do not meet required security standards. Investigating those discrepancies reinforces the importance of accountability in federal contracting.” The statement frames cybersecurity compliance as a matter of contract accountability, not solely incident response. The settlement therefore signals that agencies and enforcement authorities may scrutinize the accuracy of cybersecurity claims and the underlying evidence even when no breach is reported.

• ILC Dover LP and ILC Astrospace LLC agreed to a $13 million settlement on November 3, 2026, resolving cybersecurity-related allegations.
• $6.5 million of the settlement is designated as restitution; neither company admitted liability.
• The federal work at issue supported the Department of the Army, Missile Defense Agency, and NASA.
• The allegations involved failure to meet required cybersecurity controls while performing federal contracts.
• Inaccurate cybersecurity assessments may create legal and financial exposure when they do not match actual systems and practices.
• Contractors should validate that required controls are implemented and retain evidence supporting security representations made in contract assessments.
• Companies using third-party cloud providers should assess and oversee provider security against relevant federal contract obligations.
• The case illustrates that alleged cybersecurity deficiencies can have consequences even without a successful cyberattack or data theft.
• Contract, security, and compliance teams should coordinate reviews of system scope, cloud dependencies, control implementation, and reporting accuracy.