The Department of Justice settled a cybersecurity False Claims Act case on November 3, and nothing in the allegations required a breach. Every allegation was a contract requirement that was not met.
The DoJ release names ILC Dover LP and ILC Astrospace LLC of Frederica, Delaware, which agreed to pay $13 million. It describes claims submitted from January 2018 to October 2024 under contracts and subcontracts with the Department of the Army, the Missile Defense Agency, and NASA. The release states the claims are allegations only, and that there has been no determination of liability.
It arrived 16 weeks after the Department of War suspended CMMC Phase II. None of it depended on CMMC. Every requirement in the case was already in the contracts through DFARS 252.204-7012 and DFARS 252.204-7019.
What follows reads each allegation against the clause behind it, then against the Microsoft environments most defense suppliers run. It ends with a self-check built from the same five allegations.
DoJ Alleged Five Failures, Each With Its Own Dates
The release lists five categories, and the periods are not the same. That detail matters, because it shows DoJ tracking each obligation separately rather than treating cybersecurity as one pass-or-fail item.
| What DoJ alleged | Period in the release | Where the requirement lives |
|---|---|---|
| CUI stored with a third party without ensuring security equivalent to the FedRAMP Moderate baseline, plus DoD requirements for incident reporting, malware, media preservation, forensic access, and damage assessment | Feb 2023 to Oct 2024 | DFARS 252.204-7012(b)(2)(ii)(D) |
| No system security plan developed, documented, and periodically updated for each covered information system | Jan 2018 to Mar 2022, and Sep 2022 to Oct 2024 | NIST SP 800-171 3.12.4, through DFARS 252.204-7012 |
| Not all controls in NIST SP 800-171 and 800-53 fully implemented, including controls whose absence could lead to network exploitation or data exfiltration | Jan 2018 to Oct 2024 | DFARS 252.204-7012 and the contracts’ own terms |
| No plans of action developed and implemented to correct deficiencies and reduce vulnerabilities | Jan 2018 to May 2019, and Jan 2022 to Sep 2024 | NIST SP 800-171 3.12.2 |
| No current NIST SP 800-171 assessment submitted to DoD (ILC Astrospace); no current assessment based on the SSP and the DoD Assessment Methodology (ILC Dover) | Nov 2020 to Oct 2024 | DFARS 252.204-7019 |
Read the SSP and POA&M rows again. Both have a gap in the middle, which means a plan existed for part of the period and then fell out of date. The obligation has no expiry date, so a plan that stops being maintained is treated the same as no plan at all.
The assessment row starts in November 2020, the month the DFARS 252.204-7019 assessment requirement took effect.
The Case Did Not Need a Breach
The release does not describe an incident, a stolen file, or an attacker. It describes controls not implemented, plans not written, and assessments not submitted.
That is the shape of every cyber False Claims Act case DoJ has announced since the pause. Honeywell Aerospace settled on September 1 for more than $2 million over one network that did not meet NIST SP 800-171. LOGZONE settled in June for $507,144 after a DCMA assessment scored its implementation at -170 on a scale that runs from -203 to 110.
The theory in each is the same. A contractor that bills under a contract containing 7012 represents that it meets 7012. When it does not, the claims are the exposure, whether or not anyone ever got in.
The U.S. Attorney for the District of Delaware put it plainly in the ILC release: “The best response to cyberattacks is to prevent them from happening in the first place.”
Each Allegation Maps to a Clause Already in Your Contracts
The Cloud Requirement Covers Every Service Holding CUI
DFARS 252.204-7012 requires that any cloud service storing, processing, or transmitting covered defense information meet security equivalent to the FedRAMP Moderate baseline, and that it meet the clause’s requirements for incident reporting, malicious software, media preservation, forensic access, and damage assessment. The DoW CIO CMMC FAQ confirms it applies to every cloud service provider handling CUI (E-A1), and that encrypting the data first does not change the answer (E-A2).
The ILC allegation covers 20 months. A cloud decision made once, for convenience, can run that long before anyone checks it.
The SSP Has to Describe the System You Run Today
NIST SP 800-171 requirement 3.12.4 calls for a system security plan that is developed, documented, and periodically updated. The DoW CIO’s CMMC Assessment Guide, Level 2 defines “periodically” as “occurring at a regular interval as determined by the OSA that may not exceed one year.”
The SSP is also what the score rests on. Marking 3.12.4 Not Met produces “No CMMC Score” in SPRS (FAQ C-A10; 32 CFR 170.24).
Every SSP is accurate on the day it is approved. The trouble starts the day after.
Known Gaps Belong in a Plan of Action
Requirement 3.12.2 calls for plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities. A gap that is documented, owned, and dated is a managed gap. A gap that sits in a consultant’s report with no plan behind it is the fourth row of the ILC table.
The FAQ separates the two plan types a Level 2 environment uses. An Operational Plan of Action covers deficiencies that arise after the requirements were met, and a POA&M covers requirements found Not Met during an assessment, with 180 days to close (C-A9).
The SPRS Score Has to Be Current and Built From the SSP
DFARS 252.204-7019 requires a current NIST SP 800-171 DoD Assessment in SPRS for covered contracts, which the clause defines as not more than 3 years old unless the solicitation sets a shorter period. The score comes from the DoD Assessment Methodology applied to the SSP.
That makes the score a representation. If the SSP behind it no longer matches the environment, neither does the score.
Where These Gaps Show Up in a Microsoft Environment
The cloud allegation is the one we see most often start small. Microsoft’s DFARS compliance documentation names Azure Government, Office 365 U.S. Government, and Office 365 U.S. Government Defense as the services where it supports the 7012 requirements for cloud service providers. It makes no such statement for commercial Microsoft 365.
The tenant is rarely the only cloud in play. Engineering, manufacturing, and quality documents travel through file-sharing services, PLM and ERP platforms, supplier portals, and backup services, and each one holding CUI has to meet the same requirement.
The SSP drifts in the tenant too. A new conditional access policy, an external sharing setting, a connected app, or a second tenant brought in through an acquisition changes the system the SSP describes. The FAQ’s change sequence (F-A5) exists so those changes reach the SSP before they reach the next affirmation: a security impact analysis, a review of CUI flow, a change record, and a review with the Affirming Official before the change; an Operational Plan of Action during it; an updated SSP after it, reviewed with the Affirming Official before the next annual affirmation.
The Case Started Inside the Company
The ILC case was filed by the companies’ former Director of Cybersecurity, under the False Claims Act’s whistleblower provisions, and that relator will receive $2.35 million of the settlement. Honeywell’s began with a former employee. Swiss Automation, a precision machining subcontractor that settled in December 2025 for $421,234, began with a former quality-control manager.
The person who knows where the gaps are is usually on staff. Qui tam complaints are filed under seal, so an organization may not learn a case exists until DoJ has already investigated it. [Link: 31 U.S.C. 3730(b)(2), filing under seal.]
The record that holds up in that situation is the one that already exists: gaps written down, plans with owners and dates, and an SSP that matches the tenant. An undocumented gap is the one an insider can describe and the organization cannot answer.
The Phase II Suspension Did Not Move Any of This
The Department of War’s July 13 release keeps every Phase I self-assessment requirement in place. The DoW CIO’s implementing memo states that the requirements in DFARS 252.204-7012 remain in effect.
DoJ has said where its cyber work is heading in its own words. Its FY2025 False Claims Act fact sheet says civil cybersecurity fraud settlements “have more than tripled in each of the past two years.” In June, a Civil Division official told Congress that the Department had “opened numerous, non-public, cyber fraud matters.”
The timeline moved. The obligation did not.
A Self-Check Built From the Five Allegations
Each row below is one ILC allegation turned into a question you can answer with a document. The rows are not equal in weight. The first two cover most of the exposure we see.
| Question | The document that answers it |
|---|---|
| Does every cloud service holding CUI, inside and outside the Microsoft tenant, meet FedRAMP Moderate or equivalency? | An inventory of services that touch CUI, each with its FedRAMP Marketplace listing or equivalency evidence |
| Does the SSP describe the environment as it runs today? | The current SSP version, dated within your review interval, with changes since approval reflected in it |
| Is every known gap on a plan of action with an owner and a date? | The current POA&M or Operational Plan of Action, cross-checked against the last internal or third-party review |
| Is the SPRS score current and built from that SSP? | The SPRS entry date, the assessment that produced it, and the SSP version it was scored against |
| Are the controls implemented, or only written down? | Evidence by requirement: configuration exports, logs, and records that show the control operating |
Confirm Your SSP and SPRS Score Still Describe Your Environment
Agile IT builds and secures the Microsoft environments these requirements apply to, in GCC High and Azure Government, and maps each setting to NIST SP 800-171 for the SSP. A validation review compares the tenant, the SSP, and the score against each other, before anyone else does.
Confirm your SSP and SPRS score still describe your environment.
If DoJ read your SSP next to your tenant today, which row of that table would it start with?
Frequently Asked Questions
Did the CMMC Phase II suspension change cybersecurity obligations under DFARS 252.204-7012?
No. The Department of War’s July 13, 2026 release keeps Phase I self-assessment requirements in place, and the DoW CIO’s implementing memo states that DFARS 252.204-7012 requirements remain in effect.
Does a False Claims Act cybersecurity case require a data breach?
No. The ILC, Honeywell, and LOGZONE releases describe requirements that were not met, such as an SSP not kept current, controls not implemented, and assessments not submitted. None describes a breach.
What does “current” mean for a NIST SP 800-171 assessment in SPRS?
DFARS 252.204-7019 defines a current assessment as not more than 3 years old, unless the solicitation sets a shorter period.
Does an encrypted file stored in a non-FedRAMP cloud service still count as CUI?
Yes. Encrypted CUI keeps its designation (FAQ B-A8), and a cloud service storing it still has to meet the FedRAMP Moderate requirement (FAQ E-A2).
How often does a system security plan have to be updated?
At an interval the organization sets, no longer than one year, according to the CMMC Assessment Guide’s definition of “periodically,” and after changes that affect the system, following the sequence in FAQ F-A5.
