Honeywell Aerospace's $2.04 million cyber settlement required no breach

On September 1 the Justice Department announced that Honeywell Aerospace will pay $2,042,518 to resolve False Claims Act allegations, per Bass, Berry & Sims. A Honeywell business unit allegedly billed a Defense Department contract from April 2020 through December 2023 while its Gray and Gold Networks fell short of the NIST SP 800-171 requirements of DFARS 252.204-7012. Neither the announcement nor the settlement agreement identifies a successful cyberattack or data breach in the covered conduct, the firm notes. In the firm's reading, the exposure was the alleged gap itself.

The March 2022 qui tam alleged that a Honeywell IT unit ran SolarWinds Orion with high-level permissions on its Gray Network and failed to report a cybersecurity incident after the 2020 hack, per Manufacturing Dive. The relator will receive $375,823, just under 20 percent of the recovery, and the announcement notes no determination of liability, the Volkov Law Group writes. Per Manufacturing Dive, Honeywell Aerospace said the settlement includes no admission of wrongdoing. Bass, Berry & Sims places the case in the Civil Cyber-Fraud Initiative launched in 2021 and cites Logzone Inc.'s $507,144 settlement over similar allegations earlier this year.

The obligation sits in one contract clause; the evidence sits in network diagrams, privileged-access tools and ticket queues. The relator raised concerns after SolarWinds, the Charlotte Observer reported, yet the alleged conduct ran to December 2023, past her August 2021 departure. The Volkov Law Group argues independent verification beats point-in-time attestation. A qui tam complaint is filed under seal, so a security team may first see its record when an investigator asks for it.

• Reconcile each enclave holding covered defense information against its system security plan and SPRS score.
• Inventory privileged tools on those enclaves, monitoring software included; treat a vendor compromise as a reporting decision.
• Log security escalations as cases with an owner, decision and remediation date.

FORGE — Investigations is designed for the record a case like this one turns on: which internal escalations arrived, who owned them, what was decided, and when each follow-up task closed. It supports timestamped case files with complete auditability for security leaders and counsel across the defense industrial base. People make the determinations; FORGE is designed to keep each one on an auditable record.

The settlement extends a point we made when the CMMC pause began: DFARS 7012 and NIST 800-171 obligations did not pause, and False Claims Act exposure does not wait for an intrusion. The durable control is a network that matches the affirmation, and a dated record of each escalation.