DHS publishes Acronis exclusion and removal order for civilian agencies
DHS's October 30 Federal Register publication details an existing Acronis supply-chain security order, with contract-specific implications for federal security policy and system reviews.
Source: Cyber Defense Group. Original reporting and dates are preserved.
Douglas A. Munro Coast Guard Headquarters Building at St. Elizabeths, August 21, 2015. Archival institutional context; not an Acronis system or incident. The appearance of U.S. Department of War (DoW) visual information does not imply or constitute DoW endorsement.
Michael Hvozda/U.S. Coast Guard · U.S. public domain; no government endorsement · LicenseThe photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.
Cyber Defense Group update
DHS published an October 30 Federal Register notice covering the exclusion and removal of Acronis products from federal civilian executive-branch procurements and information systems. The notice makes an existing supply-chain security order publicly available: the signed order's original release date is July 31, 2026.
Order #2026-02 covers Acronis AG, affiliated entities and covered articles supplied directly or indirectly by them. Its scope includes federal information systems operated by contractors on an agency's behalf. National-security and sensitive compartmented information systems are subject to the separate authorities described in the order.
The order requires procurement exclusion immediately after issuance and removal from agency systems within 180 calendar days of issuance, or an exception. Written agency exception requests are specified within 60 days of issuance. October's publication should not be treated as the start of a new compliance period. During the removal period, DHS encourages traffic monitoring, enhanced logging, controls against data exfiltration and detection of anomalous activity.
Contractor obligations require a contract-specific review. The basic FAR 52.204-30 clause says an order issued after solicitation applies to that contract only if added through an amendment or contract modification. Separately, its notice-and-reporting provisions require periodic SAM.gov checks, reasonable inquiry when a new order could affect the supply chain, and reporting when covered products were supplied or used during performance. Those duties should not be treated as a blanket requirement for every contractor to remove Acronis from every corporate system.
For ISSOs, security assessors and supply-chain risk teams, the practical review is to reconcile backup and recovery inventories with the order's scope, identify the responsible system and contract owners, and verify documented removal or exception decisions. Where replacement affects recovery capabilities, teams should also review restoration testing and related security evidence. These are implementation considerations rather than additional requirements created by the October notice.
Sources and references
Source publication notes
October 30 is the Federal Register publication date, not the July 31, 2026 original issuance date.
Relative removal and exception periods run from issuance. No new deadline, closing time or timezone is inferred, and the exception-request window did not restart with publication.
Contractor applicability depends on the actual clause, solicitation or contract and affected systems. This is not an open procurement or a universal private-sector ban.
Implementation considerations are editorial analysis, not legal advice or additional requirements.
Check current official order status and agency direction; this summary does not establish exhaustive legal assurance.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.