Johnson Controls to Pay $5M for Cybersecurity Violations

• •Johnson Controls agreed to a $5 million settlement for cybersecurity violations.
• •The allegations involve failures to implement required security controls from 2018 to 2025.
• •A former employee will receive $850,000 as part of the whistleblower settlement.

Johnson Controls, Inc. and its subsidiaries will pay $5 million to settle allegations of violating the False Claims Act by failing to meet cybersecurity requirements in federal contracts. The allegations span from January 2018 to August 2025, involving contracts with NASA and the Departments of Defense, Energy, and Justice. The company reportedly did not implement necessary security controls to protect sensitive government information, leading to potential vulnerabilities. U.S. Attorney Theodore Hertzberg emphasized the importance of compliance with cybersecurity standards to prevent exploitation by malicious actors. The settlement includes a whistleblower component, with a former employee receiving $850,000 of the settlement amount under the qui tam provisions of the False Claims Act. The case highlights ongoing issues with contractor compliance in safeguarding federal data.