Three cyber settlements, one lesson: your score must be true

Checked on 8 October 2026.

What happened

Between December 2025 and September 2026, the Justice Department announced three settlements with companies doing defense work under the False Claims Act, the federal law against false claims for government money. In each case the government alleged that cybersecurity a contract required was not in place. The requirements were those of NIST SP 800-171, a list of security requirements from NIST (the National Institute of Standards and Technology) for protecting CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes, such as drawings).

Company Announced Agreed to pay What was alleged
Swiss Automation Inc., a precision machining business in Illinois 5 December 2025 $421,234 It allegedly did not adequately protect drawings of parts it machined and supplied to defense prime contractors. It allegedly knew the rules applied to suppliers too.
LOGZONE Inc., Huntsville, Alabama 18 June 2026 $507,144 On two Navy contracts, from May 2021 to March 2025, it did not put certain NIST SP 800-171 requirements in place. An assessment by DCMA (the Defense Contract Management Agency) gave it a score of -170, on a scale from -203 to 110.
Honeywell Aerospace Inc. 1 September 2026 $2,042,518 From April 2020 to December 2023, a Honeywell business unit did not meet NIST SP 800-171 on one of its networks, as a defense contract required.

Two of the cases began with a whistleblower: a former quality-control manager at Swiss Automation, and a former employee of Honeywell. The False Claims Act lets a private person sue on the government’s behalf and share in what is recovered. Their shares were $65,291 and $375,823.

The Justice Department says the claims in all three cases are allegations only, and there has been no finding of liability.

What it means for you

  • Your score is a statement to the government. SPRS is the government website where you report your results. Where a contract names a CMMC (Cybersecurity Maturity Model Certification) level, the clause DFARS 252.204-7021 (DFARS: the Defense Federal Acquisition Regulation Supplement, the defense contract rules) asks you to enter your self-assessment results there. A senior person at your company then confirms them every year. The three releases are about the security itself, not a reported score. Still, what you report needs to match what is really in place.
  • Suppliers are covered too. The Swiss Automation case was about parts it supplied to prime contractors. The Justice Department notes that the NIST SP 800-171 rules have applied to defense subcontracts since 2017.
  • The people who know are your own. Two of the three cases started with someone who had worked at the company.

What comes next

In all three announcements, the Justice Department says it will continue this work.

What to do now

  1. Report only what is really in place. If your SPRS score was entered a while ago, we suggest checking it against today.
  2. Before the senior person confirms each year, walk them through the proof for each requirement.
  3. If you find a gap, write it down, fix it, and update your score.
  4. If you supply a prime contractor, read the cybersecurity clauses in your purchase order. They are your requirements too.
  5. Give your staff a simple way to raise a security problem, and act on what they raise.

Sources