DOE orders Acronis removal from civilian IT systems under DHS supply chain security action

Traders Union
All News
Regulators
DOE orders Acronis removal

Highlights

DHS issued Federal Acquisition Supply Chain Security Act Exclusion and Removal Order #2026-02 to ban Acronis products from all new and ongoing federal procurements immediately.
DOE and NNSA must remove all Acronis software, including backup engines and data recovery tools, from civilian agency IT systems within 180 days or by January 27, 2027, unless granted an exception.
The Federal Acquisition Security Council cited Acronis products' root-level administrative access as an unacceptable supply chain risk to executive branch systems, triggering urgent operational compliance measures.

DHS order sets procurement and removal deadlines

As reported by the Department of Energy, the notice tells DOE and National Nuclear Security Administration contracting personnel that the Department of Homeland Security has issued Federal Acquisition Supply Chain Security Act Exclusion and Removal Order #2026-02 covering Acronis products and services.

The order says Acronis, a foreign privately owned company with U.S. subsidiaries, provides data protection, backup, secure file sharing and disaster recovery tools that have privileged or root access to customer security systems. DHS, acting under the Federal Acquisition Supply Chain Security Act of 2018 and related regulations, orders agencies to exclude covered Acronis articles from all ongoing and future procurements effective immediately after issuance.

The notice also requires agencies to remove all Acronis covered articles from information systems within 180 calendar days of the order, unless they seek an exception. The action extends to agency-approved product lists, service provider equipment lists, e-commerce markets and other procurement channels for information technology hardware, software and services.

Implications for federal cybersecurity operations

The Federal Acquisition Security Council determined that Acronis software agents, backup engines and data recovery tools pose an unacceptable supply chain risk to executive branch systems because they require deep, persistent and root-level administrative access across host infrastructure.

For DOE offices, the policy means Acronis products must be identified, isolated and fully removed from civilian agency systems, and new contracts may not include Acronis products or services. The department says all covered articles must be removed by January 27, 2027, linking the order to immediate procurement restrictions and near-term operational compliance work across federal IT environments.

Additional details on product scope and compliance requirements are provided in the attachment to the policy flash and in the Federal Register docket DHS-2026-0694, listed as FR Doc. 2026-22215.

Cohere’s planned acquisition of AI cybersecurity startup AISLE highlighted how AI vendors are moving into vulnerability detection to strengthen security offerings for enterprise and public-sector clients. Our earlier article noted that AISLE’s AI had already identified hundreds of previously unknown software bugs, including multiple OpenSSL vulnerabilities, underscoring how AI-driven security research is becoming a key capability as organizations reassess technology risk.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.