Aerojet Rocketdyne Holdings Inc. may have violated the False Claims Act by failing to comply with federal cybersecurity requirements under contracts for the Department of Defense and NASA, a federal court said.

Whistleblower Brian Markus, a former senior cybersecurity director for the company, adequately alleged that Aerojet Rocketdyne entered into missile defense and rocket engine contracts despite knowing it didn’t meet minimum contractual standards, Judge William B. Shubb of the U.S. District Court for the Eastern District of California, said.

Markus’s complaint satisfied the materiality requirement for a false claims case by asserting that Aerojet Rocketdyne didn’t fully disclose to...