ILC Dover Shows Cyber Compliance Claims Need Evidence

A cybersecurity compliance claim is only as strong as the evidence you can produce when someone challenges it, and the government has just put a $13 million price on the difference. The Justice Department announced that ILC Dover and ILC Astrospace agreed to pay that amount on November 3, 2026, to resolve allegations that they billed the Army, the Missile Defense Agency, and NASA while knowing they had not met the cybersecurity requirements written into those contracts. The settlement resolves allegations only, and the Justice Department’s release states that there has been no determination of liability.

Read the list of allegations and a pattern appears that has little to do with exotic attack techniques. The government says the companies stored controlled unclassified information with a cloud provider without confirming it met the required security baseline, went years without a current system security plan, left controls unimplemented, and kept no current assessment on file with the Department of Defense. Every one of those items is a documentation, verification, or evidence failure. None of them requires a breach to have happened.

That is the point a CISO or Chief Compliance Officer should carry into the next attestation meeting. The False Claims Act does not ask whether your policies sound reasonable. It asks whether the statements you made to the government were true when you made them, and whether you can prove it. This post walks through what the settlement alleges, why the current regulatory climate makes the evidence question sharper, and what a defensible position looks like for CMMC 2.0 compliance and beyond.

Key Takeaways

1. The allegations are about evidence.

Missing security plans, stale assessments, and unverified cloud storage are paperwork and verification gaps that a breach never had to expose.

2. Self-attestation moves the burden to you.

When an outside assessor is no longer the check, the contractor’s own statement becomes the document the government relies on.

3. Confidence and proof are different things.

Defense contractors report high confidence in their scores while a much smaller group can back that confidence with current records.

4. Third-party cloud is a named exposure.

Storing sensitive government information with a provider you have not verified is one of the five allegations in this settlement.

5. Audit trails are the fastest fix.

A complete, tamper-evident record of who accessed which regulated file, and when, turns a claim into evidence you can hand over on request.

What the Justice Department Actually Alleged

The settlement covers claims for payment between January 2018 and October 2024. The Justice Department’s account lists five allegations, each with its own date range, and the ranges matter because they show how long the gaps persisted.

The first concerns cloud storage. From February 2023 to October 2024, ILC allegedly used a third-party company to store controlled unclassified information in the cloud without requiring and ensuring that the provider met security requirements equivalent to the FedRAMP Moderate baseline, in the department’s wording, and complied with Department of Defense requirements for cyber incident reporting, malicious software, media preservation, and forensic access. The second concerns planning. For most of the period from January 2018 to October 2024, ILC allegedly did not develop, document, and periodically update a system security plan for each covered information system.

The third allegation is the broadest. From January 2018 to October 2024, ILC allegedly had not fully implemented the controls in NIST Special Publications 800-171 and 800-53, including controls whose absence could lead to significant exploitation of the network or exfiltration of controlled defense information. The fourth concerns plans of action and milestones, which the government says were missing for stretches of the period. The fifth is a reporting gap. From November 2020 to October 2024, ILC Astrospace allegedly submitted no current NIST SP 800-171 assessment to the Department of Defense, and ILC Dover allegedly had not submitted one that was current and conducted under the department’s assessment methodology.

Put those five together and the whistleblower’s role becomes easier to understand. Philip Root, ILC’s former director of cybersecurity, filed the case under the False Claims Act’s qui tam provisions and will receive $2.35 million of the settlement. Someone inside the company could see the distance between what had been represented and what existed, and the statute gives that person a financial reason to say so.

U.S. Attorney Benjamin Wallace of the District of Delaware framed the enforcement logic in one line. He said the best response to cyberattacks is to prevent them from happening in the first place, and that the obligations ILC allegedly violated exist to stop bad actors from exploiting American technical innovation. For a compliance leader the more useful reading is narrower. The obligations are contractual, they are specific, and the government treats a knowing gap between them and your invoices as fraud.

Why Self-Attestation Raises the Stakes

The timing of this settlement matters because it lands after the Pentagon suspended the transition to mandatory third-party CMMC assessments. CBIZ’s summary of the July 13, 2026 announcement describes a suspension of the Phase 2 transition and of pending and future CMMC milestones. Some readers took that as a pause in the underlying duty to protect information. It was not. The suspension changed who verifies a contractor’s claims, and it did not change what the contractor must be able to demonstrate.

That distinction is easy to lose in a budget meeting, so it is worth stating plainly. Self-assessment lowers the bar for entering a contract. It does not lower the bar for exposure once you are inside one. A score posted to the Supplier Performance Risk System is a representation the government relies on, which means an inaccurate one carries False Claims Act risk whether or not an assessor ever looks at it. The ILC allegations, which stretch back to 2018, are a reminder that these obligations were enforceable long before the current CMMC timeline existed. A contractor that treats the Phase 2 pause as a reprieve from NIST 800-171 compliance is misreading the situation.

The data on how contractors feel about this is uncomfortable. The Kiteworks 2026 State of CMMC 2.0 Preparedness in the DIB Report surveyed 273 organizations with an active CMMC requirement in July 2026. It found that 96 percent were confident their self-attested score would hold up under review, yet only 29 percent of that confident group could point to both a current SPRS submission and a FedRAMP-authorized platform. Those numbers are self-reported and come from a single survey, so they describe a pattern and not a census.

The pattern shows up from a second direction. CyberSheath’s 2026 State of the DIB study, conducted by Merrill Research among 302 U.S. defense contractors in May 2026, found that mean self-reported scores had risen while confidence in their accuracy had fallen from 89 percent the year before to 65 percent. Two independent surveys, two different samples, and the same shape. Contractors are getting better at documenting compliance and less sure that the documentation would survive a challenge.

I would not read that as pessimism. I read it as contractors correctly sensing that a score is a claim and a record is evidence, and that a government attorney only cares about the second.

Third-Party Cloud Is Where the Evidence Breaks

The first allegation deserves its own section because it describes the situation most organizations are in right now. ILC allegedly stored sensitive government information with an outside provider and did not verify that the provider met the required baseline. Almost every contractor uses outside providers. The question the allegation raises is whether you have the records that show you checked.

The federal authorization landscape is also shifting underneath this question. On November 2, 2026, FedRAMP published a memo announcing that it had granted the first full FedRAMP 20x Class C certification on October 29, 2026, and that 26 companies had earlier received limited pilot certifications. For a procurement team that matters, because the labels on provider documentation are changing while the contractual question stays the same.

Be careful with the translation between old and new terms. Secureframe’s guidance on Class C cautions that Class C inherits the market position of the former Moderate tier and not its requirements, and that agencies with their own control-level expectations may need artifacts a Class C package does not contain. The practical lesson is to read the contract clause, identify the baseline it actually names, and keep a dated record of how you verified that each provider meets it. That record is the thing that turns a vendor’s claim into your evidence, and it belongs in your third-party risk management file, not in an email thread.

A few habits make this defensible. Maintain an inventory of every provider that touches controlled unclassified information. Store the provider’s current authorization or assessment documents alongside the date you reviewed them. Record who at your organization accepted any residual risk. If a provider’s status changes, the change should trigger a documented review and not wait for an annual cycle.

Healthcare Pays Differently for the Same Gap

The compliance stakes are not confined to defense. The same week brought a healthcare reminder. Court documents summarized by ClassAction.org show that Covenant Health and affiliates agreed to a $2 million class settlement over a May 2025 cyber incident, with the protected health information of about 502,606 people exposed. The defendants maintain there was no wrongdoing, and a final fairness hearing is expected in early 2027.

The headline number looks modest next to a nine-figure breach story, yet it excludes the organization’s own response, legal, and notification costs, which the settlement does not capture. Class members can claim up to $5,000 in documented losses and receive two years of credit monitoring, so the obligation does not end with the check. The plaintiffs’ claims were negligence-based, which means the legal question became whether reasonable safeguards were in place and whether the organization could show it.

That is the same evidence question in a different regulatory costume. Under HIPAA, the Security Rule already expects access controls and audit controls, and an organization that cannot reconstruct who touched protected information is arguing from assertion. The proposed overhaul of that rule is still a proposal and not final, so the argument today rests on obligations that already exist.

What Evidence-Quality Compliance Looks Like in Practice

It helps to be concrete about what “evidence” means, because the word gets used loosely. An evidence-quality record has four properties. It is dated, so a reader can tell when the control was verified. It is attributable, so it names the person or system that produced it. It is complete, so it covers the whole population of systems and files in scope and not a hand-picked sample. And it is protected from alteration, so no one can quietly improve the story after a question arrives.

Apply that test to the five ILC allegations and each one maps to a missing artifact. A provider verification file would answer the cloud allegation. A current, versioned system security plan would answer the planning allegation. A control-by-control implementation record, with owners and test dates, would answer the broad NIST SP 800-171 allegation. A live register of open items with target dates would answer the plans of action allegation. A submitted assessment with the score and the method used would answer the reporting allegation. None of these is exotic, and all of them are the kind of document that slides when a team is busy shipping product.

The useful habit is to treat every external statement about security as a deliverable with an owner. When sales says a customer’s data is protected to a named standard, when finance signs an insurance application, when an executive certifies a score, each statement should point to a record that someone has checked this quarter. Teams that do this find that the gaps surface in ordinary reviews, when fixing them is cheap, and not in a deposition, when it is not. It also gives the CISO and the Chief Compliance Officer a shared vocabulary. The CISO owns whether the control works, the CCO owns whether the statement about it is true, and the evidence record is where those two answers meet.

There is a cultural dimension as well. People close to the work usually know where the paperwork and the practice diverge, and they will say so if the organization makes it easy. The ILC case is a reminder of what happens when it does not. Build the internal escalation path first, and treat early disclosure of a gap as a sign the program is working.

What a CISO and CCO Should Do Before the Next Attestation

The following steps assume you will sign something that the government or a customer will rely on. They are ordered by how quickly each one reduces exposure.

Start with a reconciliation of every statement you have made about your security posture against the underlying records. Compare the score or status you reported with your current system security plan, your open plans of action and milestones, and your most recent assessment date. Any mismatch is a finding you should discover before an outsider does. A structured CMMC gap analysis is a reasonable way to run it.

Next, assign a named affirming official and give that person real access to the evidence. A signature from someone who cannot see the logs is a liability for them and for you. Then test whether you can produce a complete record of access to sensitive content within a day, because a regulator or assessor will not wait for you to assemble one. The audit trail should show who accessed which regulated file, when, and under which policy, and it should be protected from alteration.

Finally, rehearse the whistleblower scenario. Ask who inside your company knows where the documentation and the reality diverge, and give that person a safe internal channel before the statute gives them a different incentive. The ILC case began with a cybersecurity director who saw the gap. Most organizations have someone like that, and what matters is whether the first conversation happens internally.

A One-Week Test of Your Own Evidence

A practical way to test whether your compliance story would survive scrutiny is to run a small exercise before anyone external asks. Pick one contract that carries a security requirement and trace it end to end. Start with the sentence you used to describe your posture, wherever it appears, whether a proposal, an annual affirmation or a customer questionnaire. Then find the record that supports each part of it. If the sentence says a baseline is met, locate the plan, the assessment date and the most recent review. If it says a provider is authorized, locate the authorization material and the date you last checked it.

Most teams find at least one claim whose supporting record is stale, scattered across systems or held by one person. That is a useful result and not a failure, because it tells you where the exposure sits while fixing it is still inexpensive. Write the gaps down, assign an owner and a date to each, and keep the list. A dated remediation record is itself evidence. The government’s account of the ILC allegations includes stretches without plans of action and milestones, so the habit of keeping and updating them is directly relevant.

How Kiteworks Supports Evidence-Quality Compliance

The pieces of this problem that involve moving sensitive content, such as email, file sharing, managed file transfer, and web forms, are where evidence is most often scattered across separate tools. Kiteworks secure data exchange puts those channels under one set of policies and one audit trail, so that the record of who sent, shared, or received a regulated file exists in a single place. That design helps a compliance team answer an evidence request from one source and not five.

It supports the work described above, and it does not replace it. A platform can produce records and enforce policy, but the system security plan, the risk acceptance decisions, and the attestation itself remain your organization’s responsibility. Kiteworks provides secure email and secure managed file transfer with audit events that can be forwarded to a SIEM through syslog, and assessors, not vendors, decide whether a given control satisfies a requirement.

To learn more about building audit-ready evidence behind your cybersecurity attestations, schedule a custom demo today.

Additional Resources

• Blog Post The Tug-of-War Over Your Data: How the CLOUD and SHIELD Acts Pit Security vs. Privacy
• Blog Post Secure Sensitive Data by Mapping DSPM to Your Compliance Goals
• Brief Top 3 FERPA Violations and How to Avoid Them
• Blog Post Executive Order 14117: Protecting Americans’ Bulk Sensitive Personal Data
• Blog Post Need NIS2 Compliance? Start With ISO 27001