# Johnson Controls agrees to $5 million settlement over cybersecurity allegations

_Published Sunday, November 15, 2026 at 1:06 AM EST · Policy, Security · Latest · Tier 2 — Notable_

Johnson Controls and two subsidiaries have agreed to pay $5 million to resolve allegations that they failed to meet cybersecurity requirements in federal contracts, the Justice Department announced. The False Claims Act settlement covers building products and services, including heating, ventilation and air conditioning.

The allegations concern contracts with NASA and the Departments of Defense, Energy and Justice from January 2018 to August 2025. They include inadequate controls over access to protected government information and failures to maintain required security plans or adequately develop and implement corrective measures.

The settlement resolves two whistleblower lawsuits. Former employee Kelly Vance will receive $850,000. The claims remain allegations, with no determination of liability.

## Sources

- [Justice News](https://www.justice.gov/opa/pr/hvac-supplier-johnson-controls-inc-and-two-subsidiaries-agree-pay-5-million-settle)

---
Canonical: https://techandbusiness.org/newswire/uWlS6XDAIE5SP03PjYry0S
Published: 2026-11-15T06:06:01.868Z
Story chronology: 2026-11-13T14:55:01.000Z
Retrieved: 2026-11-15T06:58:32.641Z
Publisher: Tech & Business (techandbusiness.org)