Johnson Controls agrees to $5 million settlement over cybersecurity allegations

Johnson Controls and two subsidiaries have agreed to pay $5 million to resolve allegations that they failed to meet cybersecurity requirements in federal contracts, the Justice Department announced. The False Claims Act settlement covers building products and services, including heating, ventilation and air conditioning. The allegations concern contracts with NASA and the Departments of Defense, Energy and Justice from January 2018 to August 2025. They include inadequate controls over access to protected government information and failures to maintain required security plans or adequately develop and implement corrective measures. The settlement resolves two whistleblower lawsuits. Former employee Kelly Vance will receive $850,000. The claims remain allegations, with no determination of liability.