Honeywell Aerospace pays $2 million to settle NIST 800-171 False Claims Act case

On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations tied to gaps in NIST SP 800-171 security controls on one of its networks from April 2020 to December 2023, according to Secureframe's CMMC news tracker. The whistleblower who brought the case receives $375,823. The settlement came about seven weeks after the Department of Defense suspended the third-party assessment phase of its CMMC program.

The case is a reminder that cybersecurity obligations in federal contracts are enforced through fraud law, not only through audits. Contractors that handle controlled unclassified information attest to their NIST SP 800-171 compliance and post scores to the Supplier Performance Risk System. If those claims are inaccurate, the company can face False Claims Act liability, and employees who know about the gaps can file whistleblower suits and share in any recovery. The Justice Department's Civil Cyber-Fraud Initiative continues regardless of the CMMC pause.

If you hold DoD contracts, compare your posted SPRS score against an honest review of your current controls, and correct it if it is overstated. Keep your system security plan and plans of action current and dated. Encourage staff to raise security gaps internally and make sure those reports are tracked and fixed, because unresolved internal complaints are a common source of whistleblower cases.

If you rely on an MSP or cloud provider for parts of your compliance, make sure the contract spells out which NIST controls they cover and what evidence they will provide.

Sources

1.Secureframe ↗secureframe.com

Vendor in this insight

Honeywell

Diversified automation and building technology company (NASDAQ: HON) undergoing a planned separation into Honeywell Automation and Honeywell Aerospace by H2 2026. The Building Automation division — the most advisory-relevant segment — operates millions of installed systems globally across fire prevention, building controls, access control, and security under brands including NOTIFIER (fire alarm), LenelS2 (enterprise access control), Onity (hospitality locks), System Sensor (detection devices), and Xtralis VESDA (aspirating smoke detection). Honeywell Forge is the connected enterprise IoT and analytics platform spanning building, industrial, and process automation with an OT cybersecurity suite (Forge Cybersecurity+, incorporating SCADAfence) that addresses ICS/SCADA security for building automation and industrial control networks — a distinct capability from IT-focused cybersecurity vendors.

View vendor profile

Does this affect your business?

Our advisors can help you figure out the right move, at no cost.

Talk to an advisor

Honeywell Aerospace pays $2 million to settle NIST 800-171 False Claims Act case

More on Compliance & Governance

HHS agenda lines up HIPAA access-deadline and health IT rule proposals for late 2026

DoD suspends CMMC Phase 2 third-party assessments, but core requirements stay

HHS pushes final HIPAA Security Rule overhaul to July 2027