$13 Million Lesson: Your SPRS Score Is a Promise to the Government

On November 3, 2026, the Department of Justice announced that defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve False Claims Act allegations. The government said they billed the Army, the Missile Defense Agency, and NASA while knowing they were not meeting their contracts’ cybersecurity requirements.

The case came from a whistleblower: ILC’s own former Director of Cybersecurity. He will receive $2.35 million of the settlement.

The Allegations

The alleged conduct ran from 2018 to 2024. The gaps will be familiar to any DIB contractor:

• Unvetted cloud storage. ILC allegedly stored CUI with a third-party cloud provider without confirming it met FedRAMP Moderate equivalency or DoD’s incident reporting requirements.
• No current System Security Plan for each covered system.
• NIST SP 800-171 controls not fully implemented. This included controls whose absence could allow significant network exploitation.
• No working POA&Ms for fixing the known deficiencies.
• Bad or missing self-assessments. One entity allegedly never submitted a current NIST SP 800-171 assessment to DoD. The other allegedly submitted one that wasn’t current, wasn’t based on its SSP, or didn’t follow the DoD Assessment Methodology.

These are allegations, and no final determination of liability has been reached.

Why This Matters to Contractors

None of these are advanced failures. They are basic requirements: an SSP, POA&Ms, an accurate score, and a compliant cloud provider.

The legal risk comes from the gap between what a company reports and what it has actually implemented.

As U.S. Attorney Benjamin L. Wallace put it:

“The best response to cyberattacks is to prevent them from happening in the first place.”

Two lessons stand out:

1. Your score is a claim to the government. If you can’t back up your SPRS submission, it can become False Claims Act exposure.
2. The whistleblower may be inside your company. The people who know where your gaps are have a strong financial reason to report them.

Find Your Gaps Before Someone Else Does

CMMC requirements are now showing up in defense contracts, so contractors have less and less room to rely on self-attestation alone.

We can help you check your SSP, cloud providers, POA&Ms, and before a contracting officer, an auditor, or a whistleblower does.

Reach out to us today!