Cybersecurity Compliance Credential Authority Failure Through System Security Plan Not Implemented Across 29 DoD Contracts at Raytheon

Defense contractors handling Covered Defense Information — a category of sensitive but unclassified information — are required under DFARS to implement the cybersecurity controls defined in NIST SP 800-171. Those controls must be documented in a System Security Plan that describes how the contractor's information systems satisfy each requirement. Raytheon, a major defense contractor and subsidiary of RTX Corporation, held contracts and subcontracts with the Department of Defense for work performed on an internal network. That network processed, stored, or transmitted Covered Defense Information. Under DFARS 252.204-7012, the network was required to meet NIST 800-171 and be covered by a compliant System Security Plan.

In March 2024, RTX sold its Cybersecurity, Intelligence, and Services business to Nightwing Group, a new entity headquartered in Dulles, Virginia. The business that transferred included the contracts and the operational history associated with the noncompliant network. When the DOJ announced the settlement in May 2025, Nightwing was named alongside Raytheon and RTX as a settling party — held liable as successor for conduct that predated the acquisition by three years.

The qui tam suit was filed in August 2021 by Branson Kenneth Fowler Sr., a former director of engineering at Raytheon, who alleged that Raytheon had submitted false claims by certifying compliance with cybersecurity requirements it had not met. The DOJ intervened. The government's theory was that Raytheon's contracts required compliance with DFARS 252.204-7008 and 252.204-7012 — both of which mandate NIST 800-171 implementation and a corresponding System Security Plan — and that Raytheon had used a noncompliant network to perform contract work while submitting claims that did not disclose this noncompliance. FAR 52.204-21, requiring 15 basic safeguarding requirements for covered contractor information systems, was also cited.

The $8.4 million settlement, announced May 1, 2025, resolved the allegations. No data breach or incident involving Covered Defense Information was alleged. As in the HNFS case, liability arose from the knowing submission of false compliance certifications — not from harm that had been realized, but from a credential that did not correspond to the security architecture it represented.

The compliance certification submitted under DFARS functions as a credential. It asserts, as a condition of contract performance and payment, that the contractor's systems meet defined cybersecurity requirements. The contracting officer accepts the certification. There is no independent mechanism to verify the security architecture it represents at the point of contract performance or payment. The credential is the instrument. What the credential asserts — that a System Security Plan satisfying NIST 800-171 is implemented on the relevant network — is not evaluable by the relying party through the credential itself.

The case introduces a dimension not present in prior catalog entries: the credential's false assertion did not terminate with the entity that submitted it. When RTX sold the Nightwing business, the acquisition transferred not only the operational assets but the liability for the compliance representations made during the period of noncompliance. The credential's evidentiary gap — the absence of a correspondence between what was certified and what was implemented — traveled with the business. Nightwing, which did not exist during the period of alleged noncompliance, was held liable as successor for the credential failures of the predecessor.

This successor liability dimension establishes that compliance credential failures are not bounded by the entity that created them. When a business is acquired, the credential history transfers. The evidentiary boundary that was never encoded in the original credential becomes a liability that the acquiring entity inherits without the ability to evaluate at the point of acquisition what the predecessor's credential actually represented.

The $8.4 million settlement resolved the FCA allegations without admission of liability. The whistleblower received $1.5 million as his relator share. The settlement was the fifth announced under the DOJ's Civil Cyber-Fraud Initiative in 2025 and notable for the explicit naming of Nightwing as successor in liability — a signal to defense contractors and their acquirers that cybersecurity compliance credential failures do not disappear in acquisition. DOJ enforcement activity in cybersecurity FCA matters continued to accelerate through 2025, with recoveries totaling more than $52 million across eight cases.