Johnson Controls and two subsidiaries have agreed to pay $5 million to resolve federal allegations that they failed to protect government information while performing federal contracts. The Justice Department announced the settlement Friday, Nov. 13. The signed agreement identifies 25 contracts and subcontracts and sets out which costs the company must keep off future federal bills.
The government alleged that the companies failed to meet all of the security requirements between January 2018 and August 2025. The contracts involved NASA and the Departments of Defense, Energy and Justice. The companies did not admit liability in the settlement, and the government did not withdraw its position on the merits of the claims.
The contracts in the agreement
The signed agreement lists the covered contracts and subcontracts in Exhibit A. The exhibit includes purchase orders, subcontracts and a credit-card purchase. That list sets the boundaries of the civil claims the companies agreed to settle. Readers can use it to distinguish covered transactions from the companies’ other federal work.
The common requirement was protecting information the companies handled for those jobs. Different contracts put that requirement in different terms. Some Defense Department contracts pointed to technical standards from the National Institute of Standards and Technology. A NASA clause addressed the confidentiality, integrity and availability of unclassified electronic information. The agreement also singles out an Energy Department contract that required the contractor to protect project papers and other materials designated for official use only. Information can be unclassified and still subject to restrictions on who may see it.
For the Defense Department contracts cited, the government says Johnson Controls lacked a system security plan that fully met the requirements. Such a plan describes which systems are covered and how the contractor meets its obligations. The government also alleged that the companies failed to adequately document, develop or carry out plans to correct deficiencies. The two documents serve different purposes. A security plan describes how protections work at the time. A corrective plan tells the government how the company proposes to address gaps and on what schedule.
What the $5 million covers
The agreement identifies about $2.43 million of the $5 million as restitution, just under half of the principal. It also calls for interest at 5% a year from June 12, 2026, until payment. Once the government receives the settlement payment, the agreement provides for $850,000 to go to one of the whistleblowers. The companies separately agreed to pay specified legal fees and expenses to the two whistleblowers’ lawyers.
The agreement also says the companies cannot charge the government for certain costs tied to the case. Those include the settlement payment and expenses associated with the investigation, defense and certain corrective work undertaken in response to the government inquiry. The companies must account for those costs separately and keep them off federal bills, even as indirect charges. The companies have 90 days from the agreement’s effective date to identify and repay any such costs previously submitted for federal payment. The government reserves the right to audit their accounting.
The settlement addresses specified civil claims. It reserves other government remedies, including possible suspension or debarment, which can limit access to future federal work. The agreement calls for the parties to file papers dismissing the two civil actions after the government receives the settlement payment. It defines which civil claims the government releases and preserves its rights in other matters.
Johnson Controls separately disclosed a cybersecurity incident in a 2023 securities filing. That filing describes disruptions in its corporate systems. The settlement records allegations about contract compliance over a longer period. The contract case concerns how the companies handled government information across the period listed in the agreement.
