Enforcement Didn't Pause: The Honeywell Settlement, the First FCA Cyber Dismissal, and What They Mean for Your Compliance Posture

By Josh Hammer

The CMMC pause is not a compliance holiday

Imagine two headlines arriving in the same week.

First, the Department of Justice announces that Honeywell Aerospace will pay $2,042,518 to resolve allegations that one business unit failed to comply with NIST SP 800-171 requirements on a Department of Defense contract.

The next day, a federal judge dismisses a cybersecurity False Claims Act complaint against Archer Daniels Midland because the relator failed to plead materiality with enough precision.

One headline suggests that cyber enforcement remains active. The other looks like a defense victory.

Both are true. Together, they reveal the direction of federal contractor cybersecurity enforcement: less formalistic, more fact-specific, and increasingly focused on the quality of a contractor’s evidence and decision-making record.

This is the central point for contractors navigating CMMC 2.0 readiness:

CMMC Phase 2 has been suspended, but the underlying obligations have not disappeared. The pause has made evidence quality, not certification status, the new center of gravity.

Contractors that maintain a live control environment will be better positioned than those that treat the suspension as a break.

What happened in September?

On September 1, 2026, DOJ announced the Honeywell settlement. According to the DOJ press release, the allegations concerned conduct from April 2020 through December 2023. A Honeywell business unit allegedly submitted claims for payment while failing to meet NIST SP 800-171 cybersecurity requirements applicable to one network under a DoD contract.

Former employee Rachel Tenney, who filed the whistleblower action, will receive $375,823.

Assistant Attorney General Brett A. Shumate stated that contractors handling defense information must follow required cybersecurity standards and that DOJ would continue investigating potential violations. U.S. Attorney Russ Ferguson similarly emphasized that companies benefiting from government contracts have an obligation to protect sensitive data.

The settlement contains no admission or determination of liability. Nevertheless, it is an important enforcement signal. The government did not need to wait for a publicly reported breach to pursue the matter. The theory centered on alleged noncompliance and claims for payment.

The background is also significant. DOJ’s Civil Cyber-Fraud Initiative recovered more than $50 million across nine cybersecurity settlements in 2025. In March 2025, MORSECORP agreed to pay $4.6 million after DOJ alleged that the contractor reported an NIST SP 800-171 score of 104 when its actual score was -142.

Then, on September 2, Judge Sunil R. Harjani issued a different kind of signal in United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145. The court granted ADM’s motion to dismiss a cybersecurity FCA complaint for lack of materiality. The first such dismissal in years.

The apparent contradiction is easy to resolve: DOJ is willing to enforce cybersecurity representations, but courts still require relators to prove the elements of an FCA claim.

CMMC Phase 2: what changed and what did not

On July 13, the Department of War suspended the advancement of CMMC Phase 2. The DoW CIO memorandum paused the planned transition that would have required third-party C3PAO assessments for many contractors handling controlled unclassified information.

The suspension was later reflected in DFARS Class Deviation Revision 3 of 2026-O0025 on September 3, 2026. The CMMC Reform Task Force delivered its report to DoW CIO Kirsten Davies around September 11, but the report had not been made public as of September 28.

The practical relief is real. During the suspension, contracting activities may require Level 1 or Level 2 self-assessments, but they may not impose Level 2 C3PAO or Level 3 DIBCAC assessments under the suspended implementation schedule.

That does not mean the following obligations have vanished:

• Applicable NIST SP 800-171 requirements.
• Accurate self-assessments and SPRS affirmations.
• System Security Plans and documented plans of action and milestones.
• Government-led assessments where authorized.
• DFARS 252.204-7012 requirements, including the 72-hour cyber-incident reporting clock, media preservation, investigation support, and subcontract flowdown.

The operative DFARS 252.204-7012 clause remains in force.

The reason for the pause was partly economic. SBA-cited estimates placed compliance costs at nearly $600,000 per firm, raising concerns about the effect of third-party assessment requirements on small and midsized defense contractors. But reducing the burden of certification is not the same as reducing the obligation to safeguard information.

“No third-party assessment required” is not “no liability.”

A contractor may still face exposure if it:

• Affirms compliance that it cannot demonstrate.
• Submits an SPRS score without a defensible methodology.
• Leaves known control gaps unexplained.
• Fails to update decision-makers when an assessment changes.
• Represents that a system is protected when its boundaries, data flows, or controls are unclear.

The materiality fight: why ADM matters

The False Claims Act does not impose liability for every imperfect compliance program. A relator must establish, among other elements, that a false statement or omission was material to the government’s payment decision.

The Supreme Court’s decision in Universal Health Services v. United States ex rel. Escobar defined materiality as demanding. A requirement is not material merely because a contract labels it a condition of payment. The issue is whether the alleged misrepresentation had a natural tendency to influence, or was capable of influencing, the government’s payment decision.

Judge Harjani applied that principle in ADM. The court held that simply designating cybersecurity compliance as a condition of payment was not enough. The relator needed specific facts showing that the government would have acted differently (such as withholding payment, refusing funding, or taking another meaningful step) if it knew about ADM’s alleged deficiencies.

The decision also addressed implied certification. A contractor does not make an actionable “implicit” certification merely by requesting payment. The relator must identify an affirmative statement that became misleading because of an omitted fact, a half-truth, or identify a specific omission tied to the payment request.

That is a meaningful defense for contractors. But it is narrow.

The complaint was dismissed without prejudice. The court found that scienter had been adequately pleaded because executive leadership allegedly knew about a 2019 audit and a 2022 report identifying cybersecurity problems. The court also found it plausible that ADM possessed CUI on its systems.

This is the lesson: internal knowledge can strengthen a relator’s case even when materiality remains contestable.

The question is not whether your organization has ever discovered a gap. Every serious program finds gaps. The question is what happened next:

• Did leadership understand the gap?
• Was the scope of affected systems documented?
• Was the contract analyzed?
• Was a remediation plan approved?
• Were representations updated?
• Did the organization continue making certifications without resolving the conflict?

A negative audit is not automatically evidence of fraud. Ignoring a known audit finding while making unsupported compliance representations is a different matter.

DOJ’s Justice Manual revision: binding rules versus useful evidence

On September 18, DOJ revised its Justice Manual to limit the use of sub-regulatory agency guidance as a substitute for statutes, regulations, or contractual obligations. The September 2026 analysis of the revisions explains the distinction.

Guidance, standing alone, generally cannot create a binding obligation where no statute, regulation, or contract does so.

But contractors should not overread this change.

Guidance may still be evidence of:

• Notice and knowledge.
• Scienter.
• Industry or professional standards.
• How an agency interpreted an existing requirement.
• A contractor’s own understanding of its obligations.

Further, if a contract incorporates a standard or guidance document by reference, the contractual language may make compliance binding. The source of the obligation then becomes the contract, not the guidance document in isolation.

The revision also directs DOJ attorneys to consider whether to seek dismissal of qui tam actions that do not advance the government’s interests under 31 U.S.C. § 3730(c)(2)(A). That does not mean every declined case will disappear. It does mean DOJ’s role may continue after declining intervention, particularly where a case lacks merit, duplicates an investigation, burdens government resources, or conflicts with agency interests.

For contractors, precision matters. Before responding to an allegation, identify the actual source of each requirement:

1. The statute or regulation.
2. The contract clause.
3. An incorporated standard.
4. A solicitation representation.
5. A certification or affirmation.
6. Guidance that may be relevant evidence but is not independently binding.

What should you preserve in your compliance record?

The best defense is not a large archive. It is a coherent record showing how your organization made decisions.

Preserve:

• Legal and compliance analyses.
• Contracting officer communications.
• Contract interpretations and clause-mapping decisions.
• System boundaries and data-flow diagrams.
• SPRS methodology and supporting calculations.
• System Security Plans and POA&Ms.
• Internal audit findings.
• Risk acceptances and remediation approvals.
• Evidence showing completed corrective actions.
• Training, policies, and control-owner assignments.
• The factual basis for every annual affirmation.

An annual affirmation that you cannot evidence is not a formality. It is a liability.

Compliance is a process before it is a platform

This is where many organizations make an expensive mistake. They purchase a compliance tool before understanding their scope, obligations, control ownership, or evidence gaps.

A compliance automation platform can accelerate work. It cannot decide whether your contract incorporates a particular requirement, whether a finding affects a covered system, or whether leadership received information that changes the accuracy of a certification.

The proper sequence is:

1. Conduct an audit. Establish scope, identify systems and data, test controls, and document gaps.
2. Build a plan. Assign owners, prioritize remediation, define evidence requirements, and determine what can be affirmed.
3. Select solutions. Automate repeatable collection, mapping, monitoring, reporting, and escalation.

At H&V Complynt, we take that distinction seriously. The Complynt platform is designed to support the compliance process, not replace it.

Complynt provides automated control mapping, evidence collection, continuous monitoring, pre-built content packs, and policy-as-code. It can help organizations map once and satisfy many across CMMC, NIST SP 800-53, NIST SP 800-171, SOC 2, and RMF requirements.

That matters for federal contractors and facility operators managing complex environments, including facility-related control systems. A hybrid model combines automation with human expertise, while infrastructure authorized for FedRAMP High and DoD IL5 environments supports organizations with demanding security requirements.

Whether you are seeking a CMMC compliance automation platform, NIST 800-53 compliance automation, RMF compliance solutions, a DoD IL5 compliance platform, or a SOC 2 automation tool, the starting point should remain the same: understand the process and your evidence posture first.

Three things to take away

First, CMMC Phase 2 is paused, not the underlying cybersecurity obligations. Self-assessments, SPRS affirmations, DFARS requirements, and potential government-led assessments remain relevant.

Second, ADM is a defense win, not an enforcement retreat. Materiality must be pleaded with specific facts, and condition-of-payment language alone is insufficient. But internal audit findings and executive knowledge can support scienter.

Third, evidence quality is now the competitive advantage. Contractors that maintain current controls, accurate affirmations, defensible interpretations, and continuous evidence will be better positioned when the next certification or enforcement cycle arrives.

The pause has created time. The question is how you use it.

Are you treating the CMMC suspension as breathing room, or are you using it to build a compliance record that can withstand an audit, a government inquiry, or a whistleblower complaint? Share your perspective in the comments.

This article is for informational purposes only and is not legal advice. Contract clauses, agency guidance, and enforcement policies change frequently; consult qualified counsel regarding your specific obligations.