Honeywell's $2 Million Settlement Shows the CMMC Pause Did Not Pause Liability

Your contractual obligation to implement NIST SP 800-171 did not pause when CMMC Phase 2 did. On September 1, 2026, the Justice Department announced that Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that it failed to meet NIST SP 800-171 requirements on a network used for defense work (U.S. Department of Justice). The case was brought by a whistleblower, and the requirement at issue was DFARS 252.204-7012, which is still in every covered contract.

We wrote recently about why defense contractors should keep moving while Phase 2 is paused. This settlement is the clearest illustration so far of why. Certification timelines changed. Enforcement of existing clauses did not.

What the government alleged

According to DOJ, from April 2020 through December 2023, Honeywell Aerospace did not meet NIST SP 800-171 requirements on one of its networks, which it referred to as the "Gray Network," that was used for work on defense contracts. Honeywell did not admit liability. The relator, Rachel Tenney, will receive $375,823 of the settlement. The case is United States ex rel. Tenney v. Honeywell International Inc., No. 3:22-cv-129 in the Western District of North Carolina (DOJ).

Two details stand out. First, the allegations concerned a single network, not the whole company. Scope boundaries matter, and a segment that drifts out of compliance is enough. Second, the case started with an insider. Employees who see a gap between what the company certifies and what it does have a financial incentive to report it.

Part of a pattern

This is not an isolated case. Earlier in 2026, LOGZONE paid $507,144 after a self-reported SPRS score of 110 was contrasted with a DIBCAC assessment score of negative 170 (The Defense Compliance Report). Law firms tracking the Civil Cyber-Fraud Initiative read the Honeywell resolution as a sign that enforcement continues even as CMMC is reworked (Foley & Lardner; Nixon Peabody).

The mechanism is the same every time. A contractor represents compliance, through a contract, an SPRS score, or an affirmation, and the government alleges the representation was false. The False Claims Act allows treble damages and penalties per claim, which is why settlements arrive well before trial.

What to check this week

1. Re-validate your SPRS score. Re-score honestly against all 110 requirements in NIST SP 800-171 Rev 2. If it went down, update SPRS. A lower accurate score is far safer than a higher inaccurate one. Our guide to raising your SPRS score during the pause walks through the highest-weighted controls.
2. Map every network that touches CUI. Labs, engineering segments, test networks, and legacy enclaves are where gaps hide. If a network handles CUI, it is in scope.
3. Close or document POA&M items. Open plan-of-action items should have owners and dates, and they should be moving.
4. Check who signs. Make sure the person submitting scores and affirmations understands what they are attesting to.
5. Create a safe internal reporting path. If staff can raise compliance concerns internally and see them fixed, problems get resolved before they become qui tam complaints.

Where monitoring fits

Several NIST SP 800-171 requirements, including audit logging, log review, incident handling, and system monitoring, are continuous by design. They are also the ones hardest to evidence after the fact. A 24/7 SOC that retains and reviews logs for the CUI environment covers a substantial share of those requirements with evidence you can hand an assessor. For flow-down questions, see our post on DFARS 7012 obligations for subcontractors.

Cyberuptive's CMMC compliance team can run an independent re-score before you update SPRS. Start with the defense contractor assessment.

Frequently asked questions

How much did Honeywell Aerospace pay to settle the False Claims Act case?

$2,042,518, announced by the Justice Department on September 1, 2026. The whistleblower, Rachel Tenney, receives $375,823.

What did the government allege against Honeywell Aerospace?

That from April 2020 through December 2023 Honeywell Aerospace failed to meet NIST SP 800-171 cybersecurity requirements on one network, the Gray Network, used for defense contract work. Honeywell did not admit liability.

Does the CMMC Phase 2 pause reduce False Claims Act risk?

No. DFARS 252.204-7012 and its NIST SP 800-171 requirement remain in covered contracts, and SPRS scores and affirmations are still representations the government can challenge.

Should I lower my SPRS score if it is inaccurate?

Yes. Update SPRS to reflect an honest assessment. An accurate lower score with an active plan of action is much less risky than an inflated score.

What other recent cases involve SPRS scores?

LOGZONE paid $507,144 in 2026 after a self-reported SPRS score of 110 was contrasted with a DIBCAC assessment score of negative 170.