Summary
ILC Dover and ILC Astrospace agreed to a $13 million False Claims Act settlement over alleged cybersecurity compliance failures on federal contracts. The case highlights risks from inaccurate NIST 800-171 assessments, outdated SSPs, unaddressed POAMs, and cloud compliance gaps. Contractors must ensure cybersecurity attestations match documented, verifiable compliance.
The Department of Justice (DoJ) recently announced aerospace and defense companies ILC Dover and its subsidiary ILC Astrospace’s $13 million False Claims Act (FCA) settlement, signed October 26, 2026. The settlement resolves allegations of fraud under FCA involving contracts with the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration (NASA). This blow to ILC, as we’ll refer to the two companies collectively, shows us several examples of false claims.
About the False Claims Act
Under the FCA, knowingly false certifications can result in treble damages and civil penalties in the form of per-claim fees. This is what comes into play when cybersecurity requirements you’ve told the government you meet, such as Cybersecurity Maturity Model Certification (CMMC) self-assessment or, NIST SP 800-171 DoD Assessment, don’t hold up under scrutiny.
Importantly, a security breach is not required for enforcement under FCA, only false claims.
Who was the ILC whistleblower?
The whistleblower provision of the FCA allows private parties to file a lawsuit on behalf of the government when they believe that a defendant has submitted false claims for government funds. The whistleblower then receives a share of any money recovered through the suit. In this case, Philip Root, ILC’s former Director of Cybersecurity, received $2.35 million of the settlement amount.
What were ILC’s alleged false claims?
The DoJ alleged that from January 2018 to October 2024, ILC submitted false or fraudulent claims for payment on contracts with the Army, Missile Defense Agency, and NASA. The department alleges ILC knew it had not complied with those contracts’ cybersecurity requirements. The settlement resolves allegations around:
- Failure to meet flowdown requirements
From February 2023 to October 2024, ILC allegedly allowed a third-party company to store Controlled Unclassified Information (CUI) in a non-FedRAMP-equivalent cloud, while also neglecting other key cybersecurity requirements including, but not limited to, cyber-incident reporting and damage assessment.
- Failure to submit current proof of NIST 800-171 implementation
From November 2020 to October 2024, ILC Astrospace allegedly did not submit a current NIST SP 800-171 DoD Assessment based on its system security plan (SSP) associated with covered contractor information systems conducted under Department of Defense (DoD) Assessment Methodology.
- Failure to maintain an updated SSP
From January 2018 to March 2022, and from September 2022 to October 2024, ILC allegedly did not develop, document, and/or periodically update SSPs for each covered information system.
- Failure to implement NIST 800-171 and 800-53 controls
From January 2018 to October 2024, ILC allegedly did not fully implement all cybersecurity controls in NIST 800-171 and 800-53.
- Failure to implement Plans of Action and Milestones (POAMs)
From January 2018 to May 2019, and from January 2022 to September 2024, ILC allegedly had not developed and implemented POAMs designed to correct vulnerabilities in ILC’s systems.
How do I avoid False Claims Act liability?
The best defense against FCA liability is to ensure that what you tell the government about your cybersecurity matches reality. Implement NIST SP 800-171 controls, keep your SSP current, resolve POAMs, and ensure any Supplier Performance Risk System (SPRS) score you submit is supported by evidence.
CMMC Level 2 adds independent verification to that process, but it isn’t foolproof: senior officials must affirm compliance every year, and a false affirmation is its own source of exposure.
The harder part is meeting NIST 800-171 standards to begin with, while balancing your role in the defense supply chain. A managed compliance partner like Summit 7 can bring you up to compliance with federal standards for assessment with everything from IT and 24/7 Security Operations Center (SOC) support, to evidence collection and in-assessment support. Once you’ve earned a compliant status, Summit 7 provides continuous compliance support, preventing any regression in your systems.
Reach out to Summit 7 about building confident compliance today.
About the Author
