Johnson Controls Cybersecurity Settlement: $5 Million Deal Ends DOJ Fraud Case

Johnson Controls Inc. has agreed to pay $5 million to settle allegations that it failed to meet cybersecurity requirements in federal contracts and subcontracts, the United States Department of Justice announced on Friday, November 13, 2026. The settlement resolves False Claims Act claims against the Milwaukee-based building products company and two subsidiaries. The Justice Department stressed that the claims are allegations only and that no determination of liability has been made. It closes two whistleblower lawsuits.

Key Points

• Johnson Controls Inc., Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC will pay $5 million to the United States.
• The Justice Department alleged the companies failed to implement required cybersecurity controls, including a System Security Plan meeting NIST Special Publication 800-171 standards.
• The contracts covered building products and services, including heating, ventilation and air conditioning, for NASA and the Departments of Defense, Energy and Justice.
• The settlement resolves two whistleblower lawsuits under the False Claims Act. Former employee Kelly Vance will receive $850,000 as his share.
• The claims are allegations only, with no determination of liability and no finding of a hack.

What Happened

The Justice Department announced the agreement on Friday, November 13, 2026. Johnson Controls Inc. of Milwaukee, Wisconsin, and its two subsidiaries agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements in federal contracts for building products and services, including heating, ventilation and air conditioning (HVAC).

The government alleged that the failures ran from January 2018 to August 2025. During that period, its contracts and subcontracts with NASA and the Departments of Defense, Energy and Justice required security controls to protect government information. For contracts requiring NIST cybersecurity controls, it allegedly failed to maintain a compliant System Security Plan.

The United States Attorney's Office for the Northern District of Georgia issued a separate announcement of the same agreement. The resolution involved the Justice Department's Civil Division, US attorneys' offices in Georgia and the District of Columbia, and federal investigators including the Defense Criminal Investigative Service, the Naval Criminal Investigative Service and NASA's inspector general.

Background: Seven Years of Federal Building Contracts

Johnson Controls is one of the world's largest makers of building equipment, supplying heating, cooling, fire protection and security systems for offices, hospitals, schools and government facilities. Its federal work reaches into the buildings where agencies operate, and the systems it installs are increasingly connected to networks carrying sensitive information.

That connection is why the contracts carried cybersecurity conditions. When a contractor handles government data or connects equipment to federal networks, it can be required to follow published security standards. For many defence and civilian contracts, the benchmark is NIST Special Publication 800-171, a set of controls for protecting controlled unclassified information on non-federal systems. Contractors must document compliance in a System Security Plan and keep it current.

Johnson Controls Cybersecurity Settlement: The Allegations in Detail

At the centre of the case is the False Claims Act, the law the government uses to pursue alleged fraud against federal programmes. Under it, a contractor that bills the United States while failing to meet a material contract requirement can be said to have submitted false claims. Here, the allegation was that Johnson Controls certified it was meeting cybersecurity requirements when it had not done so.

The settlement resolves two qui tam, or whistleblower, lawsuits, in which private citizens sue for the government and can share in any recovery. The cases are United States ex rel. Kelly Vance v. Johnson Controls, Inc., No. 1:24-cv-2500, in the Northern District of Georgia, and United States ex rel. David Thomas v. Johnson Controls International PLC, No. 1:26-cv-448, in the District of Columbia. Vance, a former Johnson Controls employee, will receive $850,000 as his share.

Precision matters here. The Justice Department expressly stated that the claims are allegations only and that there has been no determination of liability. Its announcement does not establish that any building was hacked, information stolen, or cyberattack resulted. The case concerns contractual compliance, not a confirmed breach.

Reactions and Quotes

Acting Assistant Attorney General Jonathan Guynn of the Justice Department's Civil Division said companies working for the federal government must comply with cybersecurity standards designed to protect sensitive government information. His statement framed the settlement as a warning to federal contractors: security obligations are not optional, and the government will use the False Claims Act to enforce them.

Johnson Controls admitted no wrongdoing, and the agreement contains no finding of liability. The settlement brings both whistleblower cases to a close without a trial. For the whistleblowers, the outcome is concrete: Vance's $850,000 share rewards citizens who bring government fraud to light.

Why It Matters

The settlement matters well beyond one company and one $5 million payment. Federal agencies buy billions of dollars of building systems and services every year, and much of that equipment is now networked: remotely adjusted heating and cooling, software-run security cameras and access controls, and fire systems reporting to central dashboards. A weak link in any of those systems can become a way into a government network.

For contractors, the case is a reminder that cybersecurity is a contractual obligation, not merely an internal IT preference. Suppliers need to know which provisions apply to their work, keep records showing they meet them, and fix gaps promptly. A System Security Plan that exists only on paper, or one not kept up to date, can become the centre of a False Claims Act case years later.

What Happens Next

Johnson Controls will pay the $5 million to the United States and the two whistleblower lawsuits will be dismissed, with no trial on the allegations. The settlement creates no new rule for every private business: the requirements depended on the specific contracts involved. For the rest of the federal contracting world, the practical lesson is immediate. Contractors should review the cybersecurity clauses in their contracts, confirm their System Security Plans match the NIST standards required, and document compliance for auditors.

Frequently Asked Questions

How much will Johnson Controls pay?
Johnson Controls Inc. and two subsidiaries agreed to pay $5 million to resolve the Justice Department's allegations under the False Claims Act.

Did Johnson Controls admit wrongdoing?
No. The Justice Department said the claims are allegations only and that there has been no determination of liability.

What were the companies accused of?
The government alleged they failed to meet cybersecurity requirements, including NIST SP 800-171 controls and a compliant System Security Plan, in federal building and HVAC contracts from January 2018 to August 2025.

Who brought the case?
Two whistleblowers filed lawsuits under the False Claims Act. Former employee Kelly Vance will receive $850,000 as his share of the settlement.

Was any government system hacked?
The Justice Department's announcement does not say any system was hacked or any information was stolen. The case concerns alleged failures to meet contractual cybersecurity requirements.

Related coverage: Meta and TikTok Paid Teens Millions in Secret Settlements, Bloomberg Reveals | US Diesel Falls Below $6 a Gallon for First Time in Two Months as Crude Slide Eases Fuel Costs | US Credit Card Debt Hits Record $129 Trillion as Savings Fall Below 4%