Johnson Controls Inc. and two subsidiaries agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements in federal contracts between January 2018 and August 2025.
The Settlement
Johnson Controls, Inc., of Milwaukee, Wisconsin, and two subsidiaries agreed to pay $5 million to resolve allegations of violating the False Claims Act, according to the Department of Justice. The settlement resolves claims that the company failed to comply with cybersecurity requirements in federal contracts and subcontracts from January 2018 to August 2025.
The contracts involved agencies including the National Aeronautics and Space Administration (NASA) and the Departments of Defense, Energy, and Justice.
Whistleblower Awards
The settlement resolves two qui tam lawsuits filed under the False Claims Act. Whistleblower Kelly Vance, a former Johnson Controls employee, will receive $850,000 as a share of the settlement.
The Department of Justice noted that the claims resolved by the settlement are allegations only and there has been no determination of liability.
Key facts and where they come from
- Johnson Controls agreed to pay $5 million to settle False Claims Act allegations.
agreed to pay $5 million to resolve allegations that they violated the False Claims Act
- The alleged failures occurred between January 2018 and August 2025.
from January 2018 to August 2025, Johnson Controls entered into contracts
- Whistleblower Kelly Vance will receive $850,000.
the whistleblower, Kelly Vance, who formerly worked for Johnson Controls, to receive $850,000 as his share of the settlement.
The catch
- The claims resolved by the settlement are allegations only and there has been no determination of liability.
- The announcement does not detail specific technical breaches or compromised systems beyond the alleged lack of sufficient information and system controls.
