# DOJ Settles Georgia Contractor Cybersecurity Case

On November 13, 2026, Johnson Controls, Inc. and two subsidiaries agreed to pay **$5 million** to resolve False Claims Act allegations concerning cybersecurity requirements on federal contracts with NASA, DoD, DOE, and DOJ. The alleged failures occurred from January 2018 through August 2025. This is an enforcement outcome—not a new solicitation or contract award—and underscores the financial exposure contractors may face when required protections for government information are not maintained.

- Federal contractors should review system access controls, security plans, and remediation records against the cybersecurity requirements in their applicable contracts.
- The settlement indicates that agencies and enforcement authorities may pursue alleged noncompliance spanning multiple years; contractors supporting federal customers should be able to document both their controls and corrective actions.
- Companies providing building products and services under federal contracts can use the case to assess whether their cybersecurity practices and supporting records align with their contract-specific obligations.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 13, 2026

### Government Entities
- National Aeronautics and Space Administration (NASA)
- U.S. Department of Defense (DoD)
- U.S. Department of Energy (DOE)
- U.S. Department of Justice (DOJ)
- General Services Administration (GSA)

### Vendors
- Johnson Controls, Inc. (Federal contractor and settlement respondent)
- Johnson Controls Fire Protection LP (Federal contractor subsidiary and settlement respondent)
- Johnson Controls Security Solutions LLC (Federal contractor subsidiary and settlement respondent)

### Key Quotes
> My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors.
> — Theodore S. Hertzberg, U.S. Attorney for the Northern District of Georgia

### Sources
- [Johnson Controls settles U.S. cybersecurity fraud allegations for $5 million](https://tradersunion.com/news/companies/show/4235479-johnson-controls-cybersecurity-fraud-settlement) - Traders Union
- [$5 million settlement reached after company allegedly failed to protect sensitive government data – WSB-TV Channel 2 - Atlanta](https://www.wsbtv.com/news/local/5-million-settlement-reached-after-company-allegedly-failed-protect-sensitive-government-data/T2NG6ZQ6N5ELFJGR3PZE67WWOU) - WSB-TV