Cybersecurity · Industry brief

On September 1, 2026, the U.S. Department of Justice announced a $2,042,518 False Claims Act settlement with Honeywell Aerospace Inc., resolving allegations that the company failed to comply with NIST SP 800-171 cybersecurity requirements in a Department of War contract from April 2020 through December 2023. The settlement, arising from a qui tam whistleblower lawsuit filed by a former employee, continues DOJ's escalating enforcement posture under the Civil Cyber-Fraud Initiative launched in October 2021. In fiscal year 2025 alone, DOJ recovered $52 million across nine cyber-related FCA settlements, part of a broader trend that has seen cybersecurity fraud resolutions more than triple in recent fiscal years, with total FCA recoveries reaching a record $6.8 billion. The case underscores DOJ's willingness to pursue defense contractors for lapses affecting discrete systems or enclaves, not only systemic failures, and highlights the central role of insider whistleblowers as a primary driver of cybersecurity enforcement. This enforcement activity gains significance as the government has paused implementation of the Cybersecurity Maturity Model Certification (CMMC) 2.0 program, potentially extending reliance on cybersecurity self-certifications and making enforcement actions more critical for ensuring contractor compliance with CUI-related requirements.

Cribl's acquisition of Radiant Security's AI SOC assets signals intensifying consolidation in an overcrowded cybersecurity market. (Source: Omdia)

On September 11, 2026, the Federal Reserve, FDIC, NCUA, and OCC proposed revised third-party risk management guidance to replace their 2023 framework, shifting from prescriptive requirements to a risk-based approach. The Proposed TPRM Guidance emphasizes proportionate oversight tied to the magnitude and likelihood of harm rather than enumerated checklists, with a comment period closing November 16, 2026 (91 Fed. Reg. 58,536). A companion Joint Statement on Community Banks' Engagement with Core Service Providers identifies enforcement jurisdiction over core providers serving community banks, focusing on provider transparency, contractual features, technology investments, and operational resilience capabilities, while noting that certain core providers may qualify as institution-affiliated parties subject to enforcement action under the Federal Deposit Insurance Act. The Federal Reserve separately proposed a Third-Party Risk Management Guide for Traditional Community Banking Organizations with assets below $30 billion, organizing third-party risk by eight vendor categories including cybersecurity providers, and addressing operational resilience, information security, compliance, and financial resilience (91 Fed. Reg. 58,438). The NCUA's participation in the Proposed TPRM Guidance marks the first time federally insured credit unions are included in this interagency framework.