DHS publishes Acronis exclusion and removal order for civilian agencies

DHS published an October 30 Federal Register notice covering the exclusion and removal of Acronis products from federal civilian executive-branch procurements and information systems. The notice makes an existing supply-chain security order publicly available: the signed order's original release date is July 31, 2026.

Order #2026-02 covers Acronis AG, affiliated entities and covered articles supplied directly or indirectly by them. Its scope includes federal information systems operated by contractors on an agency's behalf. National-security and sensitive compartmented information systems are subject to the separate authorities described in the order.

The order requires procurement exclusion immediately after issuance and removal from agency systems within 180 calendar days of issuance, or an exception. Written agency exception requests are specified within 60 days of issuance. October's publication should not be treated as the start of a new compliance period. During the removal period, DHS encourages traffic monitoring, enhanced logging, controls against data exfiltration and detection of anomalous activity.

Contractor obligations require a contract-specific review. The basic FAR 52.204-30 clause says an order issued after solicitation applies to that contract only if added through an amendment or contract modification. Separately, its notice-and-reporting provisions require periodic SAM.gov checks, reasonable inquiry when a new order could affect the supply chain, and reporting when covered products were supplied or used during performance. Those duties should not be treated as a blanket requirement for every contractor to remove Acronis from every corporate system.

For ISSOs, security assessors and supply-chain risk teams, the practical review is to reconcile backup and recovery inventories with the order's scope, identify the responsible system and contract owners, and verify documented removal or exception decisions. Where replacement affects recovery capabilities, teams should also review restoration testing and related security evidence. These are implementation considerations rather than additional requirements created by the October notice.