Johnson Controls Pays $5M to Resolve Federal Cybersecurity Allegations

On November 13, 2026, Johnson Controls, Inc., Johnson Controls Fire Protection LP, and Johnson Controls Security Solutions LLC agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements in federal contracts for building products and services. The Milwaukee-based heating, ventilation, and air conditioning supplier and its subsidiaries held contracts with NASA, the U.S. Department of Defense (DoD), the U.S. Department of Energy (DOE), and the U.S. Department of Justice (DOJ) that required specific protections for government information. The alleged violations occurred between January 2018 and August 2025. The settlement resolves allegations; it is not a new solicitation or contract award and does not constitute a finding of liability in the source material.

Federal prosecutors alleged that the companies did not adequately control access to protected information because of insufficient system controls. They also alleged that Johnson Controls failed to maintain a compliant system security plan and did not document or implement plans to correct deficiencies and reduce system vulnerabilities. These claims underscore the operational breadth of cybersecurity obligations: contractors may need to demonstrate not only that safeguards exist, but also that required plans are maintained, weaknesses are addressed, and corrective actions are documented over time. The source lists the General Services Administration (GSA) among the agencies, although the detailed account identifies contracts with NASA, DoD, DOE, and DOJ.

The agreement resolves two whistleblower lawsuits filed under the False Claims Act’s qui tam provisions, which allow private citizens to bring cases on behalf of the United States and share in recoveries. Former Johnson Controls employees Kelly Vance and David Thomas brought the actions. Vance will receive $850,000 under the agreement. The cases were filed as United States ex rel. Vance v. Johnson Controls, Inc. in the U.S. District Court for the Northern District of Georgia and United States ex rel. Thomas v. Johnson Controls Int’l PLC in the U.S. District Court for the District of Columbia. For contractors, the qui tam mechanism is a reminder that compliance concerns may reach enforcement authorities through current or former employees as well as through agency oversight.

The enforcement message is relevant beyond building products and services providers. U.S. Attorney for the Northern District of Georgia Theodore S. Hertzberg said, “My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors.” DOJ officials also stressed that contractors must meet required standards to protect sensitive government information and taxpayer funds. GovCon teams can use the case as a prompt to compare contract clauses and applicable cybersecurity requirements against system access controls, security plans, vulnerability remediation, and the records that substantiate implementation. The central procurement implication is sustained, demonstrable compliance across the life of federal work—not merely policy language or one-time attestations.

• Settlement amount: Johnson Controls, Inc. and two subsidiaries agreed to pay $5 million to resolve False Claims Act allegations.
• Alleged period: The cybersecurity issues were alleged to have occurred from January 2018 through August 2025, a span of more than seven years.
• Federal customers identified in the detailed account: NASA, DoD, DOE, and DOJ; GSA is also listed in the source agency information.
• Alleged control gaps: Insufficient system controls to restrict access to protected information, failure to maintain a compliant system security plan, and failure to document or implement corrective plans.
• Whistleblower actions: Former employees Kelly Vance and David Thomas filed qui tam lawsuits; Vance is to receive $850,000 under the agreement.
• Case venues: The Vance action was filed in the U.S. District Court for the Northern District of Georgia; the Thomas action was filed in the U.S. District Court for the District of Columbia.
• Contractor action: Map each applicable contract’s security obligations to system access controls and verify that current security plans and implementation evidence are maintained.
• Remediation evidence: Retain dated records showing identified deficiencies, corrective actions, implementation status, and vulnerability-reduction efforts; the allegations specifically included failures to document or implement plans.
• Compliance governance: Building products and services companies supporting federal customers should assess whether cybersecurity controls and supporting records remain aligned with contract-specific requirements over time.