HVAC Supplier Johnson Controls Inc. and Two Subsidiaries Agree to Pay $5 Million to Settle Cybersecurity Fraud Allegations

Johnson Controls, Inc., of Milwaukee, Wisconsin, and two subsidiaries, Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC (collectively, “Johnson Controls”), have agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements in their federal contracts and subcontracts for building products and services, including heating, ventilation, and air conditioning (HVAC) services.   

“Federal contractors must follow required cybersecurity standards to safeguard sensitive government information,” said Acting Assistant Attorney General Jonathan Guynn of the Justice Department’s Civil Division. “The Justice Department will continue working with its law enforcement partners to ensure that federal agencies and taxpayers get what they paid for and to hold accountable government contractors who violate cybersecurity requirements.”

The settlement resolves allegations that from January 2018 to August 2025, Johnson Controls entered into contracts and subcontracts with the National Aeronautics and Space Administration (NASA) and the Departments of Defense, Energy, and Justice that required Johnson Controls to implement security controls to protect government information. Johnson Controls allegedly failed to control access to protected information due to a lack of sufficient information regarding its information systems and a lack of sufficient control over those systems. In addition, for contracts that required Johnson Controls to comply with cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, including Department of Defense contracts, Johnson Controls allegedly failed to maintain a System Security Plan that met the contractual requirements and failed to adequately document, fully develop, or fully implement a plan of action and milestones to correct deficiencies and reduce or eliminate vulnerabilities in its information systems.

“Cybersecurity requirements are of the utmost importance to the government,” said U.S. Attorney Theodore S. Hertzberg. “My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors."

“Cybersecurity requirements in federal contracts are not optional.  They are binding obligations that protect sensitive government information,” said Director James Ives of the Department of Defense Office of Inspector General Defense Criminal Investigative Service (DCIS).  “Contractors who fail to meet these obligations jeopardize the security and trust fundamental to doing business with the federal government. DCIS and our law enforcement partners will continue to investigate violations and pursue accountability for contractors who disregard their cybersecurity obligations.”

“Defense contractors who misrepresent their cybersecurity credentials and fail to safeguard critical infrastructure pose a direct threat to our Department of the Navy installations and warfighters,” said acting Special Agent in Charge Brian Merkal, Naval Criminal Investigative Service (NCIS) Economic Crimes Field Office. “NCIS and our federal partners will relentlessly pursue any company or contractor who cuts corners on security mandates and leaves us vulnerable to adversarial threats.”

“A secure digital infrastructure is just as critical to NASA's operations as the physical building products and services Johnson Controls provides,” said Kathryn Sheehey, Senior Official at the NASA Office of Inspector General. “By failing to control access to sensitive information, this contractor put America’s space program at risk. Today’s settlement underscores that circumventing federal cybersecurity requirements incurs steep financial penalties.”

“Government contractors must be honest and vigilant in protecting the sensitive information entrusted to them,” said Special Agent in Charge Floyd Martinez of the General Services Administration (GSA) Office of Inspector General (OIG) Southeast and Caribbean Investigations Division. “GSA OIG and our law enforcement partners remain committed to holding contractors accountable when they put national security at risk for financial gain.” 

The settlement resolves two qui tam or whistleblower lawsuits filed under the False Claims Act, under which private citizens can sue on behalf of the government and share in any recovery.  The settlement provides for the whistleblower, Kelly Vance, who formerly worked for Johnson Controls, to receive $850,000 as his share of the settlement.  The qui tam cases are captioned United States ex rel. Kelly Vance v. Johnson Controls, Inc., No. 1:24-cv-2500 (N.D. Ga.) and United States ex rel. David Thomas v. Johnson Controls Int’l PLC, No. 1:26-cv-448 (D.D.C.).

This year the Administration launched the Task Force to Eliminate Fraud and the National Fraud Enforcement Division to enhance the Administration’s war on fraud, waste, and abuse in federal programs. When unscrupulous actors exploit these programs for their own financial gain, they defraud the government, harm the people these programs are designed to aid and protect, and undermine American businesses that play by the rules. The Civil Division’s FCA enforcement plays a critical role in combatting such fraudulent schemes, recovering billions of dollars for the American taxpayers, and holding wrongdoers accountable. FCA matters will continue to be on the forefront of the battle against fraud, and the Civil Division’s FCA work will support and advance the mission of the Task Force to Eliminate Fraud and the National Fraud Enforcement Division.

The resolution obtained in this matter was the result of a coordinated effort between the Department of Justice Civil Division, Commercial Litigation Branch, the U.S. Attorney’s Offices for the Northern District of Georgia and the District of Columbia, Defense Criminal Investigative Service, NCIS, Air Force Office of Special Investigations, NASA OIG, Department of Energy OIG, the Department of Justice OIG, and GSA OIG. 

The matter was handled by Trial Attorney Jennifer Cook, Assistant U.S. Attorney Adam Nugent for the Northern District of Georgia, and Assistant U.S. Attorney Sean Tepe for the District of Columbia. 

The claims resolved by the settlement are allegations only and there has been no determination of liability.

Note: The settlement can be found here.