CYBER COMPLIANCE · CONTRACT EVIDENCE

You signed the cybersecurity promiseCan the business show it was kept?

DATE 2026.9.2

Relieved Group Investigation and Risk Advisory

Sales sees the new contract. IT sees the delivery work. Two years later, a customer asks for historic access reviews and nobody can say who was supposed to keep them. The signature survived; the supporting record did not.

On September 1, 2026, the US DOJ announced an approximately $2.04 million Honeywell Aerospace settlement over alleged unmet cybersecurity requirements in a defense contract. A former employee brought the whistleblower case. The settlement did not determine liability.

The analysis below concerns the gap between contract statements and operating evidence. It does not allege an unreported breach or additional wrongdoing by Honeywell.

Key Points

Before accepting a demanding customer contract, establish six things:

Tie each promise to a system, period and accountable owner.
Separate written policy from evidence of execution.
Label planned controls, completed work and approved exceptions accurately.
Check the actual scope and dates of supplier certifications.
Preserve internal warnings and the responses they received.
Coordinate evidence preservation, technical remediation and legal review.

1. The news raises a question about proof

A contract statement may pass through sales, legal, IT and management before it reaches a customer. If planned work becomes a statement of completed compliance along that route, later billing and assurances can rest on a mistaken premise.

Historic evidence matters. A control fixed today does not prove it operated last year. A current screenshot may say little about the environment covered by an earlier invoice. Review the actual period and scope of the statement being tested.

2. Scope is where a convincing document can mislead

A business may run production systems, testing environments, legacy tools and outsourced platforms. A certificate can cover only some of them. Matching the company name is insufficient when the service being purchased sits outside the assessed boundary.

Build a short contract evidence register: the requirement, affected asset, owner, supporting record, exception and approval deadline. An unresolved row is a question to settle before signing or renewal, while the commercial team still has room to negotiate accurately.

3. Connect four sets of records

External statements

Keep proposal versions, questionnaires, contract schedules and approval records.

Operating evidence

Review authorised configuration history, work tickets, tests and recurring reviews.

Exceptions

Record who identified each gap, how it was assessed and what action was approved.

Commercial consequences

Connect performance, invoices, customer notices and supplier dependencies to the same timeline.

4. Preserve the report before reshaping the account

Restrict internal reports to those who need them and keep originals, attachments and receipt times. Interviews should separate direct observation, information received from others and inference. A report should not be rewritten merely to make it more comfortable for management.

Urgent security work can proceed alongside an investigation. Record the before and after states, the reason for change and the person carrying it out. Counsel should guide preservation and interviews where a dispute is anticipated, with appropriate protection for reporting employees.

5. What Relieved Group can contribute

We can organise commitments, work records, reports and decisions into a traceable chronology, and check supplier backgrounds and document origins. That gives management and counsel a basis for distinguishing established facts from assumptions and missing evidence.

Qualified technical assessors determine whether a control meets the relevant standard. Investigative work examines people, processes and representations so that a narrow technical report is not used to support a much broader commercial promise.

6. A final reminder: keep the proof with the promise

Before agreeing the price, ask what the business could produce if the customer requested verification tomorrow. Ask again at renewal, particularly after an acquisition, system migration or outsourcing change.

Good record ownership prevents a room full of people relying on the same explanation: everyone thought another department had done it.

FAQ | Cybersecurity Contracts and Evidence Review

Do we need a contract review if there has been no data breach?

Yes. Performance can be examined independently of an incident. List the customer requirements, relevant environments and retention periods, then sample the execution records. An absence of incidents does not prove compliance, but it also does not establish a breach of contract. Counsel should assess any legal consequence against the actual wording and applicable law.

Can a certification answer every customer questionnaire?

No. Certifications have defined scope, dates and exclusions, while a questionnaire may cover other systems or activities. Link each response to supporting material and disclose partial implementation or exceptions accurately. Reusing a previous project response is particularly risky after a system migration or supplier change. Have the relevant owner verify the answer before it leaves the business.

Can we fill historic evidence gaps after the event?

You can organise surviving records, but must not invent or backdate evidence. A later explanation should identify when it was prepared, what supports it and what remains uncertain. Keep it separate from contemporaneous material. Where an earlier statement or invoice may be affected, legal and technical teams should jointly assess correction and notification requirements.

Should all staff be interviewed immediately after a report?

First identify the allegation, records at risk and authorised custodians. That informs interview order and avoids unnecessarily spreading disputed accounts. Broad questioning can influence recollections or prompt changes to relevant material. Respect employment rights, confidentiality and local rules, while recording conflicting accounts rather than choosing the one most convenient to management.

Does outsourcing transfer all responsibility to the supplier?

Not automatically. Customer terms, supplier contracts and oversight obligations may allocate responsibilities differently. Check that the supplier report covers the service you promised and the relevant period. Investigation can establish who did what, what was communicated and what records survive. Counsel determines the resulting legal responsibility under the particular arrangements.

Does Relieved Group certify compliance or guarantee an audit result?

No. We provide investigation, document verification, chronologies and evidence organisation. Certification and technical assessment remain with the appropriate specialists. Scope, authority and deliverables are agreed before work begins. The output is a documented factual basis for management and legal review, including limitations, rather than an unconditional endorsement of compliance.

Related Services

RELATED SERVICE

Supplier Due Diligence

Check document origins, service scope and counterparty background.

RELATED SERVICE

Corporate Fraud Investigation

Examine gaps between statements, access, reports and decisions.

RELATED SERVICE

Litigation Support

Organise document versions and performance evidence.