In this piece
Honeywell Aerospace’s cybersecurity settlement is a reason to check whether your contract commitments match the controls operating on the relevant network. DOJ announced the resolution on September 1, 2026. The resolved claims remain allegations, with no determination of liability, according to the DOJ announcement.
What DOJ alleged
DOJ said the settlement concerned a Honeywell business unit’s alleged failure to meet NIST SP 800-171 requirements on one network from April 2020 through December 2023. The government alleged that the unit submitted false payment claims while failing to satisfy cybersecurity requirements imposed by its contract and regulation.
The matter arose from a whistleblower lawsuit brought by a former employee. The release does not identify individual failed controls or describe a CMMC assessment failure.
Start with the contract and the network
For contractors reviewing their own exposure, start with the obligations actually attached to the work. Have the contract owner and security lead identify the applicable clauses, system boundary, and supporting evidence together.
DFARS 252.204-7012 addresses adequate security for covered contractor information systems and specifies NIST SP 800-171 requirements for systems within paragraph (b)(2). Check the version and any authorized variations applicable to your contract. The current clause also addresses incident reporting and external cloud providers; include those obligations in the review.
Use a worksheet that another reviewer can follow:
| Review item | Evidence to locate | Owner to involve |
|---|---|---|
| Contract obligation | Applicable clause and version | Contract manager |
| System boundary | Network description and information flows | System owner |
| Control implementation | Configuration records and test results | Security lead |
| Known gaps | Open findings, decisions, and assigned actions | Remediation owner |
| Customer statements | Submitted representations and their supporting records | Authorized signatory |
Trace a customer statement to its evidence
Select one statement your organization has submitted about the relevant network’s security. Locate the evidence available when that statement was made, then ask the system owner to explain what it establishes. Record any period or part of the network the evidence leaves unresolved.
- Statement: Exact wording, submission date, and authorized signatory
- Support: Configuration records or test results for the described environment
- Changes: Later changes that affect the statement’s accuracy
- Exceptions: Known gaps and their status at submission
If the review identifies missing evidence for collaboration controls, request a defense pilot to evaluate that evidence gap with IRONKEEP. Define what the reviewer needs to observe and use synthetic files for the test. Confirm deployment suitability and contractual requirements before introducing controlled information.
Resolve differences before making assurances
If a configuration record conflicts with a customer-facing statement, preserve both and involve the responsible security, contracts, and legal reviewers. Record what was observed, which environment it concerns, and which time period the evidence covers. Avoid describing a planned correction as an implemented control.
Set the next review around one contract, one network, and the people authorized to describe its security posture. Keep the resulting decisions with the supporting evidence so the next reviewer can reconstruct what was known and what still needed work.
Plan your CMMC workspace.
Request a defense pilot and get the Level 2 readiness checklist: 39 prompts across 11 assessment areas.