Johnson Controls Inc., based in Milwaukee, Wisconsin, and two of its subsidiaries have agreed to pay $5 million to resolve federal allegations that they failed to meet cybersecurity requirements in United States government contracts, the Justice Department announced on Friday, November 13, 2026.
Source: U.S. Department of Justice
The agreement covers Johnson Controls Inc., Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC. The Justice Department said the case was brought under the False Claims Act, the federal law the government uses against alleged fraud in federal programs, and involved contracts and subcontracts for building products and services, including heating, ventilation and air conditioning (HVAC) work.
What the government alleged
According to the Justice Department, from January 2018 to August 2025 Johnson Controls held contracts and subcontracts with the National Aeronautics and Space Administration (NASA) and the Departments of Defense, Energy and Justice that required the company to put security controls in place to protect government information. The government alleged the company failed to control access to protected information because it did not have sufficient knowledge of its own information systems and did not have sufficient control over them.
For contracts that required compliance with the National Institute of Standards and Technology (NIST) Special Publication 800-171 — including Department of Defense contracts — the government further alleged that Johnson Controls failed to maintain a System Security Plan that met the contract requirements, and failed to adequately document, fully develop or fully implement a plan of action and milestones to correct deficiencies and reduce or eliminate vulnerabilities in its systems. These are allegations set out by the government in the settlement announcement; they have not been decided by a court.
What officials said
“Federal contractors must follow required cybersecurity standards to safeguard sensitive government information,” said Acting Assistant Attorney General Jonathan Guynn of the Justice Department's Civil Division. “The Justice Department will continue working with its law enforcement partners to ensure that federal agencies and taxpayers get what they paid for and to hold accountable government contractors who violate cybersecurity requirements.”
U.S. Attorney Theodore S. Hertzberg said cybersecurity requirements are “of the utmost importance to the government” and that his office “will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors.” James Ives, Director of the Defense Criminal Investigative Service (DCIS), said the requirements “are not optional” and are “binding obligations that protect sensitive government information.”
Investigators from the military and space agencies also spoke publicly. Brian Merkal, acting Special Agent in Charge of the Naval Criminal Investigative Service (NCIS) Economic Crimes Field Office, said contractors who misrepresent their cybersecurity credentials “pose a direct threat” to Navy installations and service members. Kathryn Sheehey, a senior official at the NASA Office of Inspector General, said a secure digital infrastructure is “just as critical to NASA's operations as the physical building products and services Johnson Controls provides,” and that by failing to control access to sensitive information the contractor “put America's space program at risk.” Floyd Martinez, Special Agent in Charge of the General Services Administration (GSA) Office of Inspector General's Southeast and Caribbean Investigations Division, said contractors “must be honest and vigilant in protecting the sensitive information entrusted to them.”
The Justice Department states expressly that the claims resolved by the settlement are allegations only and that there has been no determination of liability. A settlement is an agreement to resolve a case; it is not a court ruling that the company broke the law.
The whistleblower cases behind the settlement
The settlement resolves two qui tam, or whistleblower, lawsuits filed under the False Claims Act, which allows private citizens to sue on behalf of the government and share in any recovery. Former Johnson Controls employee Kelly Vance will receive $850,000 as his share of the settlement. The cases are United States ex rel. Kelly Vance v. Johnson Controls, Inc., No. 1:24-cv-2500, in the Northern District of Georgia, and United States ex rel. David Thomas v. Johnson Controls Int'l PLC, No. 1:26-cv-448, in the District of Columbia.
Source: U.S. Department of Justice
The Justice Department said the resolution was the result of a coordinated effort by its Civil Division's Commercial Litigation Branch, the U.S. Attorney's Offices for the Northern District of Georgia and the District of Columbia, the Defense Criminal Investigative Service, NCIS, the Air Force Office of Special Investigations, and the inspector general offices of NASA, the Department of Energy, the Department of Justice and the GSA. The matter was handled by Trial Attorney Jennifer Cook, Assistant U.S. Attorney Adam Nugent for the Northern District of Georgia and Assistant U.S. Attorney Sean Tepe for the District of Columbia.
Background: why cybersecurity clauses are in building contracts
Companies like Johnson Controls supply and service the heating, cooling, fire-protection and security systems inside federal buildings, military facilities and NASA sites. Those building systems are increasingly connected to computer networks, so federal contracts require the companies behind them to protect government information held on their systems. NIST Special Publication 800-171 sets the baseline controls for protecting controlled unclassified information on non-federal systems, including keeping a current System Security Plan and a dated plan to fix known weaknesses. The Justice Department linked the case to a wider enforcement push this year through a Task Force to Eliminate Fraud and a National Fraud Enforcement Division, and said its False Claims Act work recovers billions of dollars for taxpayers.
What happens next
Under the settlement, Johnson Controls pays the $5 million and the two whistleblower lawsuits are resolved, with $850,000 of the recovery going to Kelly Vance. The department did not announce any separate court order in the release, and the settlement itself does not decide liability. For other federal contractors — including the many small and mid-sized firms across Wisconsin and the Midwest that hold federal building, maintenance and technology subcontracts — officials presented the case as a warning that cybersecurity paperwork, access controls and fix-it plans are audited contract obligations, not optional extras, and that failures alleged over several years can end in a multimillion-dollar settlement.