Cybersecurity · Industry brief

The Justice Department settled with Honeywell Aerospace for $2,042,518 to resolve False Claims Act allegations that the company failed to meet NIST SP 800-171 cybersecurity requirements on a Department of Defense contract from April 2020 through December 2023. The settlement confirms DOJ's Civil Cyber-Fraud Initiative remains active, establishing that cybersecurity compliance failures can generate significant False Claims Act liability even without an actual breach, and that contractor certifications of security standards are treated as material to payment decisions. The case was initiated by whistleblower Rachel Tenney, a former Honeywell employee, who will receive $375,823 (approximately 20 percent of recovery), reflecting a pattern where cybersecurity enforcement actions are increasingly surfaced by internal personnel with direct visibility into gaps between represented and actual security posture. DOJ handled the matter jointly with the U.S. Attorney's Office for the Western District of North Carolina and the Defense Criminal Investigative Service, demonstrating the government's interagency coordination on defense contractor cybersecurity compliance failures.

On September 10, 2026, the New York State Department of Financial Services issued extensive guidance on cybersecurity risk assessments required under its DFS Cybersecurity Regulation. The guidance identifies five categories of common compliance deficiencies NYDFS has observed during examinations: incomplete asset scope and visibility, weak or inconsistent methodologies, failure to account for evolving and interconnected risks, insufficient governance and risk treatment, and failure to integrate risk assessment findings into cybersecurity program decisions. The Department emphasizes that risk assessments must employ defined and repeatable methodologies, cover all assets and emerging risks including artificial intelligence and quantum computing, evaluate third-party and supply chain risks, document the entire process with traceability linking risks to controls, and be regularly updated following material changes to business, technology, or threat environment. NYDFS stated this guidance will inform its supervision and enforcement going forward, signaling intensified regulatory focus on cybersecurity compliance. Source: Mayer Brown analysis of NYDFS guidance published September 10, 2026.

CalPrivacy ramped up enforcement against data brokers, settling with LocateSmarter, Cybba, and SalesIntel Research. LocateSmarter faced fines totaling $116,490 for failing to register as a data broker, violating CCPA data minimization requirements by requesting unnecessary Social Security number digits from consumers exercising opt-out rights, and making it harder to exercise privacy rights. Cybba and SalesIntel paid fines of $52,400 and $36,400 respectively for failing to register. CalPrivacy emphasized that businesses cannot collect more personal information than reasonably necessary and cannot require identity verification for opt-out requests. (Source: DWT Privacy & Security Law Blog, September 2026) The White House opened a program allowing vetted U.S. companies to conduct government-supervised offensive cyber operations against cyber-enabled transnational criminal organizations, authorized by a Trump National Security Presidential Memorandum signed August 12, 2026. Participating companies may engage in cyber surveillance and effects operations targeting foreign groups conducting cyber-enabled crime, subject to Department of Justice and Department of Homeland Security approval, $1 million bond requirements, and strict compliance with federal law including the Computer Fraud and Abuse Act. Operations cannot result in loss of life, serious injury, or armed attack. The extent of liability protection for approved operations remains unclear. (Source: DWT Privacy & Security Law Blog, September 2026) CISA is expected to issue implementing regulations for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) this month, with effectiveness 60 days after publication. CIRCIA requires covered critical infrastructure entities to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours. The federal government also plans to amend the Federal Acquisition Regulation with new incident reporting and cybersecurity requirements for federal contractors, with final rules potentially issued this month, including eight-hour incident reporting to CISA and compliance with security baselines. (Source: DWT Privacy & Security Law Blog, September 2026)