Federal contractors increasingly depend on commercial cloud providers to store, process, and protect sensitive Government information.
Outsourcing those functions can improve efficiency and reduce the need for internal infrastructure. But outsourcing technology does not necessarily transfer the contractor's legal responsibility for safeguarding federal information.
A November 3, 2026 Department of Justice settlement provides a significant illustration.
Defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that they violated the False Claims Act through noncompliance with cybersecurity requirements in contracts involving the Army, Missile Defense Agency, and NASA.
The settlement addresses alleged misconduct occurring between 2018 and 2024.
Among the allegations, DOJ asserted that the companies used a third-party cloud provider to store controlled unclassified information without ensuring that the provider satisfied applicable security obligations.
Those obligations included security requirements equivalent to the FedRAMP Moderate baseline and certain Defense Department cybersecurity provisions concerning incident reporting, malware, evidence preservation, forensic access, and damage assessment.
The allegations went beyond the cloud relationship.
DOJ also identified deficiencies involving system security plans, implementation of NIST SP 800-171 and SP 800-53 controls, plans of action and milestones, and cybersecurity assessment records.
The settlement resolves allegations, not adjudicated findings of wrongdoing. The companies did not receive a judicial determination of liability through the settlement.
Nevertheless, the case highlights an important federal contracting risk.
A contractor may rely on a commercial provider to operate its information systems while remaining responsible for ensuring that the resulting environment satisfies the obligations incorporated into its Government contracts.
A cloud provider's marketing claims, commercial security certifications, or general assurances may not establish compliance with every relevant FAR, DFARS, or agency-specific requirement.
That distinction becomes particularly important when a contractor stores controlled unclassified information or covered defense information outside its own systems.
For example, a contractor may believe that purchasing a secure cloud subscription satisfies its cybersecurity responsibilities. But the contractual framework may also require specific incident-reporting arrangements, access to forensic information, preservation of relevant records, restrictions on subcontractor handling of data, and evidence concerning the provider's security controls.
Those requirements must be evaluated individually.
The settlement also illustrates the importance of maintaining accurate documentation.
A system security plan should describe the systems actually used to perform the contract, their boundaries, relevant connections, and how applicable requirements are implemented.
A plan of action and milestones should provide a credible mechanism for tracking and correcting deficiencies rather than merely existing as an administrative document.
Contractors should also reconcile cybersecurity representations with their actual technical environment. A control claimed as implemented should be supported by evidence that it is operating as represented.
The case originated from a whistleblower lawsuit brought by a former cybersecurity director, reinforcing the importance of credible internal reporting and escalation procedures.
For contractors, a practical response is to review the entire information-handling chain: the prime contractor, subcontractors, cloud providers, managed security services, and other entities that may access protected Government information.
Contractual responsibility should be matched with technical verification and appropriate provider commitments.
The broader lesson is straightforward.
A contractor can outsource computing infrastructure, but it cannot assume that outsourcing eliminates its federal cybersecurity obligations.
Cloud-provider diligence should therefore be treated as a continuing contract-compliance responsibility, not merely an information-technology purchasing decision.
Recommended FedContractPros Product: Ethics & Compliance Builder
The Ethics & Compliance Builder helps contractors establish cybersecurity compliance ownership, third-party due diligence, internal reporting, remediation procedures, documentation standards, escalation mechanisms, and oversight controls.
Disclaimer:
This article is provided for general informational and educational purposes only and does not constitute legal, False Claims Act, cybersecurity, cloud-security, or government-contracting advice. The allegations described were resolved through a settlement without an adjudicated determination of liability. Applicable cybersecurity obligations depend on the contract, incorporated clauses, information handled, system architecture, and relevant regulatory requirements.