DoD contractor to pay $13 million over alleged cyber compliance failures in Army, MDA, NASA contracts - Federal News Network
Defense contractors ILC Dover LP and ILC Astrospace LLC will pay $13 million to settle allegations of knowingly misrepresenting cybersecurity compliance in contracts with the Army, Missile Defense Agency and NASA from 2018 to 2024.
The Justice Department alleges that the companies submitted false and fraudulent claims while failing to meet contractual cybersecurity requirements mandated by federal agencies. "There has been no determination of liability," the department stated in a formal announcement.
Specifically, ILC used an external cloud service provider to store controlled-unclassified information without ensuring the provider met FedRAMP Moderate baseline requirements and complied with Defense Federal Acquisition Regulation Supplement standards.
Security Failures
The government alleges the contractor failed to implement critical cybersecurity controls under NIST Special Publications 800-171 and 800-53, which could have led to significant exploitation of networks or exfiltration of defense information. ILC also neglected to develop required system security plans and plans of action and milestones to identify and mitigate cybersecurity weaknesses.
The best response to cyberattacks is to prevent them from happening in the first place. The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation.
Whistleblower Impact
The settlement resolves a whistleblower lawsuit filed by Philip Root, ILC's former Director of Cybersecurity, who will receive $2.35 million from the settlement amount. The contractor will also pay the whistleblower's attorney $288,000 for expenses and fees.
The $13 million agreement represents the largest False Claims Act cybersecurity settlement to date, highlighting the government's increasing focus on enforcing cybersecurity compliance in defense contracts.
Related
