Blog · 2026-11-11 · Gardience Engineering · How we test

Two 2026 settlements that started with NIST 800-171: LOGZONE and Honeywell

CMMC Level 2 software

CMMC Phase 2, the step that would have put outside certification into contracts, has been suspended since July 13, 2026. Enforcement has not paused. The Justice Department announced two cybersecurity False Claims Act settlements with defense contractors this year, and neither one needed CMMC to happen. Both rest on the rule that has been in contracts since 2017: protect controlled unclassified information (CUI) with the 110 requirements in NIST SP 800-171.

On June 18, 2026, LOGZONE Inc. of Huntsville, Alabama agreed to pay $507,144. The government alleged that from May 2021 to March 2025 the company submitted claims for payment on two Navy contracts while it had not implemented cybersecurity controls those contracts required under NIST SP 800-171.

How it came to light matters most. The Defense Contract Management Agency assessed LOGZONE's implementation of NIST SP 800-171 and scored it -170, near the bottom of a scale that runs from -203 to 110. DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) took part in the case. No whistleblower was involved: the government checked, and the score it found did not match the contract.

On September 1, 2026, Honeywell Aerospace Inc. of Phoenix agreed to pay $2,042,518. The government alleged that from April 2020 through December 2023 a business unit, then part of Honeywell International, did not meet NIST SP 800-171 on one of its networks, as a Department of Defense contract and regulation required.

This one started with a lawsuit by a former employee, filed in 2022 under the False Claims Act's whistleblower provisions. The government joined the cybersecurity claims, and she receives $375,823 from the settlement.

In both cases the Justice Department notes the claims are allegations only, with no determination of liability.

• No CMMC certificate was involved. Both rest on NIST SP 800-171 obligations in the contract. CMMC Phase 2 being paused changes none of that.
• Someone checked. In one case a government assessor, in the other a person who worked there. Either can look at your network and compare it with what you told the government.
• A part of the network is enough. Honeywell's case was about one network, not the whole company.
• It is the earlier settlements' pattern. MORSECORP paid $4.6 million in March 2025 on similar allegations.

1. Score from the machines, not from memory. Many requirements are settings on servers and laptops: audit logging, account lockout, session locks, encryption, patch levels. Check them on every machine in scope.
2. Score honestly, even if it is low. A low score with a dated plan of action is an honest score. A high score you cannot back up is the problem.
3. Update SPRS when you learn the real number. Do not wait for the next yearly affirmation.
4. Keep dated evidence for every requirement. Who checked what, when, and what it showed. If an assessor or a lawyer asks, that record is what answers.

Gardience checks the machine settings behind your SPRS score on every Windows and Linux machine in scope, fixes what it can with one approved click, and keeps a signed evidence pack of what it found and changed. For the policies, procedures, and records no machine can prove, it holds the proof you upload next to each requirement, and it warns you about anything to verify before an assessment. Your score comes from what is actually on your network, dated, every time you check.

Sources: Justice Department on LOGZONE, Justice Department on Honeywell Aerospace, Crowell & Moring on MORSECORP, Nixon Peabody on Honeywell.