Swiss Automation: The Security Obligation Followed the Drawing

In the Swiss Automation cybersecurity settlement, the company agreed to pay $421,234 to resolve allegations that it failed to safeguard certain drawings for parts it machined and supplied to Department of Defense prime contractors. A former quality-control manager brought the case, putting knowledge from inside a machining business at the center of a government cybersecurity claim.

The Justice Department announced the settlement on December 5, 2025. Swiss Automation is an Illinois precision-machining business supplying alloy and metal parts to commercial and government customers, including defense prime contractors and subcontractors. The government alleged that Swiss knew the security requirements reached suppliers as well as the prime contractors buying their parts.

Why a Supplier’s Part Drawings Mattered

The drawings connected Swiss Automation’s manufacturing work to its alleged cybersecurity obligation. The government said the company failed to provide adequate protection for certain drawings of the parts it supplied. That puts the information used to make a defense part inside the same business relationship as the part itself.

A prime contractor contracts directly with the government, while a first-tier subcontractor supplies that prime and lower tiers supply other subcontractors. Under the federal purchasing rules, purchase orders can be subcontracts, and suppliers, distributors and vendors can be subcontractors.

That chain also carries information. The defense safeguarding clause extends applicable duties to subcontractors handling covered defense information or operationally critical support. In Swiss Automation’s case, the Justice Department expressly alleged that the company knew the security controls applied to subcontractors and suppliers.

We see the practical point in the drawing: a supplier can be making a physical product while also holding government information it has promised to protect. The people who know the part, the customer and the systems used for the work can connect that promise to what happened inside the business. That is why this supplier case belongs in defense cybersecurity fraud.

How the Cybersecurity Obligation Reached Government Money

The Justice Department alleged that Swiss Automation caused false claims to reach the government by failing to provide the required cybersecurity for the drawings. Its account connects the inadequate safeguards to government funds through the defense work Swiss supplied. The allegation reaches a company working through prime contractors, so the payment story extends beyond the business whose name appears on the government’s own contract.

For an insider, that connection gives the technical facts a financial purpose. We examine the security obligation in the subcontract alongside the information handled for that work, the protection actually in place and the representations supporting the government business. The point is to connect a specific failure and what the supplier knew about it to the work for which the government was asked to pay.

The government’s allegation puts the cost of protecting the drawings inside the defense work the supplier accepted. We see the unfairness in that allegation: taxpayers pay for a promise left unfulfilled, while shops that honor it bear the cost of protecting the same kind of information.

A Quality-Control Manager Brought the Case

The former Swiss Automation quality-control manager brought a qui tam case under the False Claims Act in the Northern District of Illinois. The settlement resolved that whistleblower case and provided for the former manager to receive a share. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Our work on a defense contractor whistleblower claim begins with the part of the business you know and how it connects to the government’s money.

NIST Obligations Came Before the CMMC Label

The Swiss Automation announcement traced the obligation to implement NIST SP 800-171 security controls to defense contracts, subcontracts and similar agreements beginning in 2017. It described those controls as protecting certain defense information and continuing under the Cybersecurity Maturity Model Certification program. The alleged duty to safeguard the drawings was already contractual.

That history matters when the discussion inside a supplier revolves around certification. We start with the security required for the work at issue, the information involved and the controls the business actually implemented. A conversation about a certification label can leave the underlying contract promise unanswered.

There is a broader reason to look past the existence of a compliance program. A 2022 study in the International Journal of Management and Humanities, Compliance and Ethics Programs in Department of Defense Government: Relationship Between Compliance and Ethics Programs and Contracting Fraud Penalty Cost, found higher penalties relative to government contract dollars among contractors with compliance and ethics programs. The study described the association as weak. We take a narrow lesson from that finding: a program’s existence tells us less than evidence of how it operates on the work the government buys.

What an Installed Safeguard Actually Protects

In a larger cybersecurity settlement than Swiss Automation’s, Aerojet Rocketdyne agreed to a $9 million settlement over alleged misrepresentations of cybersecurity compliance on defense and NASA contracts. Its whistleblower’s first amended complaint described a revealing difference between having security equipment and using it:

The complaint also alleged that some software and hardware protected only part of the environment represented as protected. We see the absurdity in that allegation: security equipment on the inventory, protection still in the box. For a drawing-security case, the relevant comparison is the system holding the drawing and the safeguards represented as covering that system.

What Evidence Is Needed to Prove Fraud?

For a claim involving defense part drawings, the useful evidence connects the drawing, the contract, the system and the government claim. We compare the subcontract or purchase-order terms with the information the supplier handled and the cybersecurity protection it represented. That gives the insider’s technical knowledge a specific contract and payment context.

We connect the production records identifying the part and its drawing with the security assessments covering the system that held it. Dated warnings and internal decisions belong beside that comparison: they can show what people understood when they made a security representation or continued the work. We build the account around what the insider knows, what the company promised and the government money at stake.

You Know the Drawing and the System

If you know where defense part drawings went and why the supplier’s security assurances did not match the work, speak to one of our whistleblower experts. We work with you to connect production knowledge, cybersecurity obligations and government payments, then bring in defense cybersecurity whistleblower lawyers suited to the case. We stay beside you through the process, building your strongest defense cybersecurity whistleblower case from what you know.