2026 GovCon Enforcement Review: What DCAA Found and What Contractors Paid
Federal enforcement against government contractors in 2026 has centered on three kinds of records: cybersecurity representations, labor hours, and certifications about pricing, ownership, and eligibility. Between January and September, the Justice Department resolved False Claims Act allegations against defense and civilian-agency contractors in amounts ranging from $507,144 to $21.3 million. In nearly every case, the government alleged that what a contractor reported did not match what was happening in its systems, on its job sites, or inside its business structure.
The Defense Contract Audit Agency sits upstream of much of this activity. The DCAA does not levy fines; rather it audits contractor costs and advises contracting officers on whether those costs are allowable, allocable, and reasonable. Its findings, along with whistleblower complaints and assessments by other agencies, feed the cases that DOJ eventually resolves. This review covers what the DCAA reported about its own audit work, and what enforcement cost contractors this year.
Each settlement described below resolves allegations only, with no determination of liability, except where the resolution notes that a company admitted specific conduct.
What did DCAA report about its audit work?
DCAA released its Fiscal Year 2025 Report to Congress in April 2026. The agency issued 2,480 audit reports, reviewed $788 billion in contract costs, identified more than $18.8 billion in audit exceptions, and reported $5.3 billion in savings. In FY2024, it reviewed $599.8 billion in contract costs and identified $15.9 billion in exceptions. Our breakdown of the FY2025 report covers what those figures mean for labor records.
The number most relevant to contractors is the sustention rate on incurred cost audits, which rose from 31.4% in FY2024 to 42.6% in FY2025. The sustention rate measures how many of the costs DCAA questions a contracting officer ultimately upholds. A higher rate means DCAA findings are converting into disallowed costs more often than they did a year earlier.
Figure: Selected 2026 False Claims Act resolutions by category, with DCAA FY2025 audit results.
Where is DCAA focusing in 2026?
DCAA restructured on October 1, 2025, and has described several initiative areas for the current year. Contractors will see the effects in which audits they receive and who performs them.
- New directorates. DCAA replaced its contractor-dedicated Corporate Audit Directorates with Land, Sea, and Air directorates aligned to the Army, Navy, and Air Force. Contractors can identify their cognizant office by zip code, and older DCAA contact information may no longer work.
- Fixed-price work with progress payments. DCAA is receiving requests to audit fixed-price contracts with progress payments tied to costs incurred or percentage of completion. Significant modifications to firm fixed-price contracts, such as change orders that add new cost elements, can also trigger audit activity.
- Government-furnished property. As part of the Department of War’s effort to reach a clean financial audit opinion, DCAA reviewed government property records valued at more than $10 billion. Auditors have found property that could not be traced and contractor locations that did not exist.
- Truth in Negotiations. DCAA is increasing its support to procurement contracting officers on certified cost or pricing data. The FY2026 NDAA raised the certified cost or pricing data threshold from $2 million to $10 million for defense contracts entered into after June 30, 2026.
- Fewer self-initiated audits. Some Cost Accounting Standards audits and post-award accounting system reviews will now be performed mainly when a contracting officer requests them, rather than on DCAA’s own initiative.
Security: NIST SP 800-171 compliance treated as a condition of payment
Two defense contractors resolved cybersecurity False Claims Act allegations in 2026. In both cases, DOJ treated a claim for payment on a contract that required NIST SP 800-171 controls as false when those controls were not in place.
On June 18, LOGZONE Inc. of Huntsville, Alabama agreed to pay $507,144 to resolve allegations that it billed two Navy contracts while failing to implement required NIST SP 800-171 controls between May 2021 and March 2025. The Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) scored the company’s implementation at negative 170, on a scale that runs from negative 203 to 110. The settlement includes $253,572 in restitution. DOJ named no whistleblower, and the case followed a government assessment.
On September 1, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that a business unit submitted claims for payment on a defense contract while failing to meet NIST SP 800-171 requirements on one of its networks from April 2020 through December 2023. A former employee filed the underlying whistleblower suit and will receive $375,823. The exposure attached to a single network, which shows that a large contractor with a mature security program can still carry liability inside one enclave.
These cases arrived during a period of change in the Cybersecurity Maturity Model Certification program. On July 13, 2026, the Department of War suspended CMMC Phase II requirements, which removed the third-party C3PAO assessment path for Level 2 and directed contracting officers to accept self-assessments. The underlying obligations remain in force. DFARS 252.204-7012, NIST SP 800-171 Revision 2, SPRS scores, and annual affirmations all still apply. The Honeywell conduct period ended before CMMC Phase 1 began, and DOJ enforced the NIST requirements through the contract clause alone. With self-assessment now the primary verification path, the accuracy of a contractor’s SPRS score and affirmation carries more weight. In FY2025, DOJ recovered more than $52 million across nine cybersecurity False Claims Act settlements.
Labor: hours billed that did not match work performed
The two labor-related resolutions of 2026 involved civilian agencies, and both turned on the same question DCAA asks during a floor check: did the employee perform the work recorded on the timesheet?
Hanford Mission Integration Solutions (HMIS), the site services contractor at the Department of Energy’s Hanford site in Washington, paid $3.45 million to resolve allegations that it billed DOE for labor hours inflated by idle time. According to the government, HMIS did not assign employees enough work to fill their shifts and then directed them to record time as if they had worked the full shift, from August 2020 through September 2025. HMIS admitted it sought and received reimbursement for labor hours made up of unallowable excessive idle time. The whistleblower’s 2021 complaint alleged that workers were told to bill all ten hours of a shift, and sometimes overtime, to charge codes for fire suppression system maintenance. The settlement includes about $1.73 million in restitution, and HMIS separately agreed to pay nearly $1.5 million in the whistleblower’s expenses and attorney fees, bringing its total cost to nearly $5 million. The whistleblower will receive $793,500.
Phillips-Glenwood Construction of Vernon, New Jersey, agreed to pay $2.4 million, including $1.4 million in restitution, to resolve allegations that it overbilled the U.S. Postal Service on facilities maintenance work in New Jersey, Pennsylvania, and Delaware. The government alleged that between August 2020 and August 2025, the company submitted false and altered documentation that inflated its labor hours and materials purchases. Phillips-Glenwood did not admit liability.
Neither case came from the Department of War, but the mechanics apply directly to defense work. Labor is typically the largest cost element on cost-reimbursable and T&M contracts, and DCAA initiates audits when it sees a high risk of misallocated or mischarged costs. Both resolutions covered roughly five years of conduct, which reflects how long a timekeeping practice can continue before an auditor, inspector general, or employee brings it forward.
FAR compliance: pricing, conflicts of interest, eligibility, and property
The largest 2026 resolutions involved certifications and representations that sit outside the timesheet but inside the FAR: what a contractor charged, who controlled the work, and whether required disclosures were accurate.
Pricing
On March 17, W International and two affiliated companies, along with their chief executive, agreed to pay $10.5 million to resolve allegations that they knowingly overcharged the Air Force and Navy for weld tables. The funding came through an Air Force Technology Investment Agreement and through Supplier Development Funds under a Navy prime contract with General Dynamics Electric Boat. DCAA was among the investigating agencies.
Small business eligibility
On June 9, Broadway Electric, its subsidiary Cornerstone Contracting, and two executives agreed to pay $21.3 million to resolve allegations that from April 2017 through May 2025 they used service-disabled veteran-owned small businesses (SDVOSBs) and other small businesses as pass-through entities to win set-aside contracts. According to the settlement, the qualifying small businesses received a fixed share of contract value, typically between 1% and 3%. Broadway and Cornerstone personnel used the small businesses’ email domains and exercised signature authority in communications with federal agencies. At least one SDVOSB owner raised compliance concerns, and the arrangements did not change. The settling parties admitted many of the allegations.
A week earlier, on June 2, Officium Global and Loyal Source Government Services agreed to pay more than $3.6 million to resolve allegations that Officium won seven SDVOSB set-aside contracts between May 2017 and June 2018 while its management and daily operations were not controlled by a service-disabled veteran.
Conflicts of interest
On July 28, Sierra Nevada Company agreed to pay $7.75 million to resolve allegations that it employed a government official who, while working for both the company and the government, participated personally and substantially in three contracts awarded to the company. The government alleged the company made false statements and certifications about the absence of an organizational conflict of interest.
Parts and quality
On September 29, the former chief executive of Frazier Aviation agreed to pay $4.9 million to resolve allegations that the company sold aircraft parts using Lockheed Martin’s Commercial and Government Entity (CAGE) code without authorization, and that it used unauthorized subcontractors to make parts that did not meet quality standards.
Government property
In March, a federal jury in South Carolina returned a $15 million verdict against Fluor on a reverse False Claims Act theory, finding that the company knowingly avoided an obligation to pay the government for lost property under a property management contract. The amount does not include trebling or civil penalties, which the court had not yet determined as of mid-year. The case lines up with DCAA’s 2026 attention on tracing government-furnished property.
What patterns are auditors and investigators looking for?
Across DCAA’s stated priorities and the 2026 resolutions, six patterns recur.
- Hours that do not reconcile to assigned work. The Hanford and Phillips-Glenwood cases both turned on labor hours that exceeded the work performed. Floor checks test this directly by comparing what employees are doing to what their timesheets say.
- Charges recorded to the wrong cost objective. The Hanford complaint described idle hours billed to specific maintenance charge codes. DCAA prioritizes audits where it sees a high risk of misallocated or mischarged costs.
- Security representations that no longer match the environment. LOGZONE and Honeywell both involved NIST SP 800-171 controls that were required by contract but not implemented. An SPRS score or annual affirmation is a representation the government can test.
- Certifications about who controls the work. Broadway Electric, Officium, and Sierra Nevada each involved representations about ownership, control, or conflicts that did not reflect how the business operated.
- Cost exposure on fixed-price contracts. DCAA audits now reach fixed-price contracts with cost-based progress payments and significant change orders, which puts cost records on those contracts in scope.
- Property that cannot be located. DCAA’s government property reviews and the Fluor verdict both concern assets the government owns and the contractor must account for.
Many of these cases began with an insider. Whistleblowers filed a record 1,297 qui tam suits in FY2025, according to DOJ’s annual statistics, and DOJ reported more than 780 new filings in the first half of FY2026. Relator shares in 2026 included $375,823 in the Honeywell case and $793,500 in the Hanford case.
What this means for contractors heading into 2027
The common element across the 2026 resolutions is the distance between a record and the activity it describes. Contractors can measure that distance before an auditor or relator does by reconciling timesheets to schedules and work orders, checking that employees charge only to authorized contract codes, confirming SPRS scores against the current state of each covered network, reviewing teaming and mentor-protégé arrangements against control requirements, and tracing government property to its documented location. The FAR Council has said it intends to finalize the remaining FAR Overhaul rules before the end of 2026, and a CMMC reform report from the Department of War is expected this fall, so the rules behind several of these representations may change again within months.
The cases above resolve allegations only; there has been no determination of liability except where a company admitted specific conduct, as noted.
About AutoTime Solutions
AutoTime Solutions builds DCAA-compliant timekeeping and labor-tracking software for aerospace, defense, and government contractors. Charge-code visibility controls, correction workflows with a full audit trail, and supervisor certification are designed to keep time records aligned with the work employees perform. The three-minute DCAA Timekeeping Compliance Assessment scores your current practices across six areas.