Honeywell

Honeywell Aerospace pays $2 million to settle NIST 800-171 False Claims Act case

On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations tied to gaps in NIST SP 800-171 security controls on one of its networks from April 2020 to December 2023, according to Secureframe's CMMC news tracker. The whistleblower who brought the case receives $375,823. The settlement came about seven weeks after the Department of Defense suspended the third-party assessment phase of its CMMC program. The case is a reminder that cybersecurity obligations in federal contracts are enforced through fraud law, not only through audits. Contractors that handle controlled unclassified information attest to their NIST SP 800-171 compliance and post scores to the Supplier Performance Risk System. If those claims are inaccurate, the company can face False Claims Act liability, and employees who know about the gaps can file whistleblower suits and share in any recovery. The Justice Department's Civil Cyber-Fraud Initiative continues regardless of the CMMC pause. If you hold DoD contracts, compare your posted SPRS score against an honest review of your current controls, and correct it if it is overstated. Keep your system security plan and plans of action current and dated. Encourage staff to raise security gaps internally and make sure those reports are tracked and fixed, because unresolved internal complaints are a common source of whistleblower cases. If you rely on an MSP or cloud provider for parts of your compliance, make sure the contract spells out which NIST controls they cover and what evidence they will provide.