Your contract can still require you to protect covered defense information while CMMC Phase II is paused. The DOJ cases below describe allegations about missing protections and inaccurate assessment reports. They give you specific questions to ask about your own systems and records.
First, read what the pause changes. Then choose a case that relates to your work and try its suggested checks. Use the free worksheets to write down unanswered questions and assign the follow-up.
Sources reviewed . This page collects selected cases. It is not a live news feed or a complete enforcement history.
Check the current official program guidance
Phase II is paused. Existing safeguarding duties continue.
What changed
On July 13, 2026, the department announced that it was pausing the move to CMMC Phase II while it reviewed the program. Phase II had been scheduled to start on November 10, 2026. Read the official announcement and check the current program status for changes.
What continues
The announcement kept the Phase I self-assessment requirements in place. Contractors also still have to meet their existing duties to protect covered defense information under DFARS 252.204-7012. The program guidance describes using self-assessments and selected government-led assessments to enforce NIST SP 800-171 Revision 2.
Read the documents for your own work. Check the solicitation, contract, requirements passed down through a subcontract, and written amendments. Which information and systems do they cover? What protections must you provide? Must you submit an assessment or affirm that requirements are met? Take anything unclear to the government office responsible for the contract or your prime contractor's authorized contract contact. The general announcement cannot answer every contract question.
Check the official program sources again before relying on the status described here. This page cannot tell you when Phase II will restart or determine whether your organization complies.
DOJ's fiscal-year figures cover more than CUI
The wider enforcement record
DOJ's FY2025 False Claims Act fact sheet (PDF, pages 5–6) reports nine cybersecurity-fraud settlements and over $52 million recovered in fiscal 2025. The fiscal year ended September 30, 2025, and the figure includes cybersecurity issues beyond CUI. Do not read it as a count for calendar 2025 or as a total for CUI cases alone.
The seven detailed cases below concern defense information and assessments. Each includes questions you can work through with a free worksheet. The additional cases later on this page involve other cybersecurity requirements in government contracts.
How we checked this collection
For this collection, we read public DOJ announcements dated January 1, 2025 through October 21, 2026 and checked the official releases against DOJ's broader summaries. When more than one release covered the same matter, we counted it once. That review identified the two relevant announcements shown in the 2026 section. The collection does not include every case or non-public investigation, and it cannot tell you how likely any company is to face enforcement.
The date beside a case tells you when DOJ announced it. The entries separately identify when the conduct happened and when DOJ later updated its webpage. DOJ's FY2025 figure counts settlements in a fiscal year; this page groups selected announcements by their announcement date.
Read the outcome as carefully as the amount
The detailed cases are civil settlements about cybersecurity requirements in contracts. In every detailed case except MORSECORP, the settlement resolved allegations without a determination of liability. MORSECORP admitted specified facts as part of its settlement; its entry explains that distinction. None of these settlement outcomes is a criminal conviction.
A missing security control alone does not establish liability under the False Claims Act. The statute covers specified knowing conduct involving false claims or statements. Its knowledge standard includes actual knowledge, deliberate ignorance of whether information is true, and reckless disregard of whether it is true. It does not require proof of a specific intent to defraud.
Purposeful Security wrote the suggested checks to help you review your work. They are our interpretation, separate from DOJ's allegations and stated facts. They do not provide legal advice or make a finding about your organization.
Selected 2026 announcements, newest first
Recent enforcement announcements
DOJ announced these settlements in 2026, but the alleged conduct happened earlier. Read the linked DOJ releases for the allegations and the terms of each settlement.
Settled allegations
Honeywell Aerospace
Settlement amount
$2,042,518
DOJ announcement
Conduct described
April 2020 to December 2023
DOJ reports no determination of liability.
DOJ alleged that a Honeywell business unit submitted false payment claims while one of its networks lacked NIST SP 800-171 protections required by its contracts. Honeywell settled the allegations. DOJ announced the settlement after the July 2026 Phase II pause, but the alleged conduct happened earlier.
Is every network used for the contract accounted for?
List the networks used for work covered by the contract. Check whether your security review includes each one, especially a network managed separately from the rest of the business.
Follow one item of contract information through the places people keep, use, and send it. Compare those locations with the systems listed in your documented assessment boundary.
If you cannot tell whether a system is covered, write down the question and who will answer it. A company policy alone does not show what protections are in place on that system.
Open Data flow and list each network and service used for one work item. Record references that authorized staff can use to find the locations, without copying the information itself.
Compare that list with the Boundary sheet. Note any system or provider whose responsibilities are unclear and name the person who will resolve the question. Then review the objectives that apply to those systems.
Settled allegations
LOGZONE
Settlement amount
$507,144
DOJ announcement
Conduct described
May 2021 to March 2025
DOJ reports no determination of liability.
DOJ alleged that LOGZONE knowingly submitted false payment claims on two Navy contracts while certain required NIST SP 800-171 controls were missing. LOGZONE settled the allegations. DOJ says a government assessment identified the problems with how the controls had been put in place.
Read what the paperwork says, then look for evidence that the required protection works on the systems covered by the contract.
For each assessment objective you review, record evidence from the systems it applies to. Write down what that evidence shows and what you still need to check.
For each gap, name the person who will follow up and the next thing they will do. Read the contract and program rules before assuming that a plan to fix a missing protection makes the gap allowable.
Choose one objective that applies to your system from the official guide. In Objective review, record where the evidence is, what is missing or unclear, who will check it, and how. Put unfinished work in Action list and assign someone to do it.
Cases announced in 2025
Older cases with useful lessons
These cases concern how contractors protected information and assessed their systems, from supplier drawings to development work. Start with the case closest to your work. The newest announcements appear first.
Settled allegations
Swiss Automation
Settlement amount
$421,234
DOJ announcement
Conduct described
Defense-supplier drawings; period not stated in release
DOJ reports no determination of liability.
DOJ alleged that this precision machining supplier failed to provide required cybersecurity for certain drawings for parts it supplied to defense prime contractors, causing false claims. The DOJ release addresses subcontractors and suppliers as well as prime contractors.
Where do customer drawings go after you receive them?
Pick one drawing you receive from a customer. Check the requirements that came with it and follow where it goes after delivery.
Read the purchase order, contract clauses passed down to you, markings, and written customer instructions. A drawing is not automatically CUI. If its status or handling instructions are unclear, ask through the authorized customer or contract contact.
Find out where the drawing arrives, where people use and share it, and where copies are backed up or printed. Include production-floor systems and outside providers.
In Information log, describe the type of drawing in general terms. Note where to find its instructions, the question you need answered, and who will ask it. In Data flow, record each place the drawing goes without copying its contents into the log.
Use the Boundary sheet to review the systems and providers on that list. Read the relevant objectives in the official guide, then record the evidence you have and what is missing in Objective review.
Settled allegations
Georgia Tech Research Corporation
Settlement amount
$875,000
DOJ announcement
Conduct described
Issues described through December 2021; dates differ by issue
DOJ reports no determination of liability.
DOJ alleged that a defense-research lab lacked anti-malware protections and a system security plan. It also alleged that a campus-wide assessment score submitted in December 2020 did not reflect an actual system covered by the contracting requirements. The settlement concerned Air Force and DARPA contracts.
Did the assessment cover the systems actually doing the work?
Compare the systems described in the assessment and security plan with the devices and services used for the contract. Check evidence from those same systems.
Check that the asset inventory, system security plan, and assessment all describe the same set of systems.
Choose a sample of assets from that set. Review the protections that apply to them and any approved exceptions. If evidence is missing, record a follow-up task; a policy alone does not prove that an asset is protected.
List the actual assets and services in Boundary. Find the relevant system security plan and malware-protection objectives in the official guide. In Objective review, note where authorized staff can find the evidence and what they still need to check.
Settled allegations
Aero Turbine and Gallant
Settlement amount
$1.75 million
DOJ announcement
Conduct described
2018 to 2020 controls; June to July 2019 access
DOJ reports no determination of liability.
DOJ alleged that required NIST SP 800-171 controls were missing and that an Egypt-based software company received unauthorized access to sensitive defense files. DOJ gave credit for self-disclosure, cooperation, and prompt work to fix the problems. The release does not say how much that credit affected the settlement.
Choose an outside service used for work covered by the contract. Find out who can see the files and whether the contract allows that access.
Use approved records to review one existing transfer to the provider. Check what information was sent, who received it, where it went, who was allowed access, and which handling restrictions applied. You do not need to send another file to do this check.
Take unanswered questions about permission or protection to the people responsible for the contract and security. A worksheet entry or routine account-access approval does not give permission to disclose restricted information.
In Data flow, use the Send / share stage to record references to the recipient and provider. Write down the unanswered question and what you will do next. Keep the files themselves in their approved location.
In Boundary, list the outside service and which protections each party must provide. In Objective review, record the evidence and unanswered questions for the objectives covering access and where information can go.
Settled allegations
Raytheon, RTX and Nightwing
Settlement amount
$8.4 million
DOJ announcement
Conduct described
2015 to 2021, before Nightwing acquisition
DOJ reports no determination of liability.
DOJ alleged that an internal development system used on 29 defense contracts and subcontracts lacked a required system security plan. It also alleged missing protections for covered defense information and federal contract information. The alleged conduct happened before Nightwing acquired the business in 2024.
Does your development system handle contract information?
Ask the engineering and development teams where they create, use, and keep contract information. Include those systems in your review.
Check the development, test, and engineering systems actually used for work covered by the contract. Follow copies and anything those systems produce. Calling a system internal development does not tell you whether the information in it is CUI.
Compare those systems with the documented assessment boundary and system security plan. Check that someone is responsible for each required protection.
In Information log, describe the information type in general terms and note where to find its instructions. In Data flow, use the Create / use and Store / copy stages to record what happens in the development systems.
Review the development assets and providers in Boundary. In Objective review, record where to find evidence of the security plan and relevant protections, what is missing, and who will follow up.
Settlement with admitted facts
MORSECORP
Settlement amount
$4.6 million
DOJ announcement
Conduct described
2018 to 2023; dates differ by issue
DOJ states that MORSE admitted, acknowledged and accepted responsibility for specified facts as part of the settlement.
The settlement concerned Army and Air Force contracts. The specified facts included an assessment score of 104 that MORSE submitted in January 2021 and a consultant's score of -142 in July 2022. DOJ says MORSE did not update the score in the DoD reporting system until June 2023. The release also describes missing controls, gaps in system security plans, and problems with protections for third-party email.
Does your reported assessment match the latest evidence?
Put the assessment information you reported beside your latest review and its evidence. Check that they tell the same story.
Compare the reported score and the systems it covers with the latest authorized assessment. Include the evidence and gaps you know about.
If they disagree, write down the conflict and take it through your authorized contract and compliance process. Have the responsible people review it and make any required correction.
In Objective review, record which evidence disagrees. In Action list, name the person who will resolve the conflict and what they will do next. The workbook does not calculate a SPRS score or change anything submitted to the government.
Other cases announced in 2025
Other cybersecurity cases involving government contracts
These three settlements resolved allegations without a determination of liability. Read each entry to see which issues it covers. The amounts cannot be added together and described as CMMC penalties.
Illumina
· $9.8 million
DOJ alleged cybersecurity weaknesses and inadequate security practices for genomic sequencing systems sold to federal agencies.
What this case covers: The allegations concerned the security of a product. The settlement was not a CMMC assessment and did not concern only CUI safeguards.
DOJ alleged problems with IT-contract billing and qualifications, including offering cybersecurity services without the required GSA technical evaluation.
What this case covers: The settlement covered several kinds of contract allegations. The full amount cannot be attributed to CUI safeguards or cybersecurity controls alone.
DOJ alleged false compliance reports, delays in fixing vulnerabilities, and ignored audit findings under a TRICARE contract.
What this case covers: The case concerned protections for defense health information. This entry does not determine whether all affected information was CUI or describe a CMMC certification decision.
Separate criminal charges. The allegations are unproven.
Claims about cloud security and records used in audits
On , DOJ announced that a former manager at a government contractor had been indicted. The charges alleged false statements about cloud security and obstruction of federal audits. The release concerns FedRAMP and Defense Department cloud-security requirements.
An indictment is an allegation. The defendant is presumed innocent unless proven guilty. The review behind this page checked the charging announcement; it did not verify a later outcome in the case.
What to check: which service does the provider's claim cover?
Write down the exact service you use, the authorization the provider claims, and the contract requirements it must meet. Find the evidence supporting that claim. If the records disagree, ask the people authorized to handle contract and security questions to resolve it. Keep the evidence used in your assessment accurate.
Use the free Level 2 readiness worksheet →. In Boundary, list the provider and who is responsible for each protection. In Objective review, record where to find evidence and which questions still need answers. The workbook cannot validate a FedRAMP authorization or decide whether a cloud service meets your requirements.
Read a requirement, then look for evidence from the systems it covers. In the free Level 2 readiness worksheet, record where the evidence is, what is missing, who will follow up, and what they will do next. The workbook does not calculate a SPRS score or issue an official assessment result.
Resolve disagreements before relying on a report or statement. If the evidence does not match an assessment or something you have reported, take the issue to the people authorized to handle contract and compliance questions. They need to review what must be corrected and how. Putting a gap on a task list does not give you permission to leave a requirement unmet.
Save and edit your workbook in a location your organization has approved, using your existing Office tools. Do not send CUI, contracts, network diagrams, completed workbooks, or security evidence to this site or its contact mailbox.
If you spot an error or a source that has changed, email a correction. Describe what needs checking without including confidential information or attachments.