What happened
ILC Dover and ILC Astrospace agreed to pay $13 million to settle False Claims Act allegations that they billed the government for work on contracts whose cybersecurity requirements they had not met. The settlement covers contracts with the Department of the Army, the Missile Defense Agency and NASA across a period running from 2018 to 2024.
The government's theory is narrow and familiar. A contractor that bills for performance while knowingly failing to meet the security obligations written into the contract has submitted a false claim. The allegations here are specific: sensitive data stored in the cloud through a third party company without proper safeguards, and mandated security plans for covered information systems that were not developed or kept current.
ILC's parent, Ingersoll Rand, said it learned of the matter after acquiring ILC Dover in June 2024, moved promptly, and was in compliance with the applicable requirements by October 2024. It resolved the case without an admission of liability. Benjamin Wallace, US Attorney for the District of Delaware, said the obligations the company violated exist to stop bad actors exploiting American technical innovation.
The $13 million figure is among the larger recoveries since the Justice Department began using the False Claims Act against contractors for cybersecurity shortfalls in 2022. Because the statute lets a private party bring the allegations and share the recovery, cases like this usually begin with someone inside who knows where the paperwork diverges from reality.
Why this is a GRC story
Every invoice is an attestation. Billing for a period of performance is a representation that the terms were met. When a security clause sits inside those terms, an unevidenced system security plan is a payment risk, not just a documentation gap.
The finding is about records as much as controls. Unsafeguarded cloud storage and plans that were never updated are failures that survive audits because nobody reconciles what was promised at signature with what exists today. That reconciliation is a governance routine, not a project.
Inherited exposure is real exposure. This is the second resolution this week where a buyer carried the compliance history of an acquired company across the closing table. Diligence that reads the seller's policies but never opens the live contract obligations will miss it every time.
Ninety days is the tell. The new owner says it was compliant by October 2024, a few months after closing. Whatever produced that speed is the gap analysis every contractor with inherited programmes should run this quarter, before someone else runs it for them.
Qui tam changes the audience. The person who knows the plan is stale sits inside the programme. A speak up channel that logs concerns without tracking remediation hands that person a reason to call a lawyer instead.
What to watch
Watch whether other aerospace and defense contractors follow, because the same clauses appear on thousands of programmes and the theory does not require a breach to occur. Watch the relator share in this case, which tells insiders what a report is worth.
The useful exercise is small. Take one active contract, trace its security requirements to evidence, and check three things: a current plan per system, safeguards at every cloud provider holding sensitive data, and the date of the last review. Most teams find a stale document before lunch.
Attribution: Analysis based on CyberScoop and related public reporting. This article is original commentary, not a repost of the source material.