Johnson Controls to Pay $5 Million Over Cybersecurity Failures in Federal Contracts

Johnson Controls, one of America’s largest building-technology companies, has agreed to pay $5 million to settle allegations that it failed to meet cybersecurity requirements on federal contracts, the Justice Department announced on Friday.

The Milwaukee-based company and two subsidiaries — Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC — will pay the sum to resolve claims brought under the False Claims Act, the law the government uses to pursue alleged fraud against federal programmes. The Justice Department stressed that the claims are allegations only and that there has been no determination of liability.

The settlement covers building products and services, including heating, ventilation and air conditioning (HVAC) work, supplied to some of the most sensitive parts of the federal government.

What the government alleged

According to the Justice Department, Johnson Controls entered into contracts and subcontracts with NASA and the Departments of Defense, Energy and Justice between January 2018 and August 2025 that required it to put security controls in place to protect government information.

Prosecutors alleged the company failed to comply with those requirements. For contracts covered by defence acquisition rules, that meant implementing the safeguards set out in the National Institute of Standards and Technology’s Special Publication 800-171, which governs how contractors protect controlled unclassified information on their systems. The government also alleged the company failed to maintain a System Security Plan that met the required standards.

Acting Assistant Attorney General Jonathan Guynn of the Justice Department’s Civil Division said contractors must follow the required standards to safeguard sensitive government information.

The case was investigated with the help of the Defence Criminal Investigative Service, the Naval Criminal Investigative Service, the Air Force Office of Special Investigations and the NASA Office of Inspector General, among others.

Two whistleblowers, one settlement

The agreement resolves two whistleblower lawsuits filed under the False Claims Act, which allows private citizens to sue on behalf of the government and share in any recovery.

The first was brought by Kelly Vance, a former Johnson Controls employee, in the US District Court for the Northern District of Georgia in June 2024. The second was filed by David Thomas in the District of Columbia in February 2026.

Under the settlement, Vance is to receive $850,000 as his share of the recovery, according to TipRanks. The remainder goes to the government.

The sum is far smaller than the $7.35 billion settlement agreed by 3M earlier this month to resolve injury claims linked to so-called forever chemicals — a reminder that False Claims Act cases can range from modest penalties to multi-billion-dollar resolutions. But for contractors, the message is the same: cybersecurity compliance is now treated as a contractual obligation, not a technical nicety.

No finding of liability

Johnson Controls has not admitted wrongdoing, and the settlement agreement makes clear that the resolved claims are allegations only. That distinction matters: a civil settlement ends the dispute without a court deciding whether the company broke the law.

A warning to federal contractors

The case lands as cyber threats to government supply chains draw growing scrutiny in Washington. The FBI published a list of 628 cryptocurrency wallets earlier this month in a separate case, underscoring how federal investigators are tracing digital trails across both criminal networks and the contractors that serve them. Private-sector spending is moving the same way: CrowdStrike’s bet on securing AI agents shows how seriously the industry now takes the defence of automated systems.

For the thousands of companies that supply the federal government, the Johnson Controls settlement is a pointed reminder. Cybersecurity clauses in federal contracts carry the force of law, and the whistleblowers who work inside those companies have a direct financial incentive to report gaps.

The Justice Department has made clear it will keep using the False Claims Act to police those obligations. For Johnson Controls, the $5 million payment closes a chapter that began in 2018 — but for its rivals, the case is a warning that the bill for weak cyber defences can arrive years after the work was done.