ILC Dover LP and ILC Astrospace LLC have agreed to pay $13 million to resolve allegations that they sought payment under federal contracts while knowingly failing to meet cybersecurity requirements. The Justice Department announced the civil settlement on November 3, covering work for the Army, Missile Defense Agency and NASA.
The False Claims Act allegations concern conduct between January 2018 and October 2024. DOJ states that the claims remain allegations and that there has been no determination of liability. The agreement is not an admission of liability by ILC.
The evidence behind the requirements
The government’s allegations span both security controls and the records needed to demonstrate their implementation. DOJ says ILC failed to maintain required system security plans, fully implement NIST SP 800-171 and SP 800-53 controls, and develop and implement corrective plans of action and milestones during specified periods.
Cloud arrangements were also part of the case. From February 2023 to October 2024, ILC allegedly used a provider without ensuring security equivalent to the FedRAMP Moderate baseline or compliance with required Defense Department incident reporting and related obligations.
The settlement agreement connects assessment credibility to documentation: an assessment under the cited DoD methodology depends on a system security plan explaining how requirements are met. The government alleges that Astrospace had posted no assessment to the Supplier Performance Risk System and that Dover’s assessment did not meet the stated conditions, including currency and its basis in a security plan.
Neither document establishes that attackers exploited these alleged shortcomings or stole information. References to exploitation and exfiltration describe potential consequences of missing controls.
Practical context for security teams
For contractors reviewing their own programs, the practical lesson is to connect each compliance statement to evidence. A security plan should describe the systems actually in scope; assessment records should reflect the controls operating there; and remediation tracking should make unresolved gaps visible to the people responsible for contractual representations.
Cloud reviews deserve the same discipline. Teams can use this case as a prompt to check what their provider agreements and supporting records establish about the particular safeguards and reporting responsibilities their contracts require.
