The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying Acronis products and to remove the ones they run. The order uses the Federal Acquisition Supply Chain Security Act, or FASCSA. Secretary Markwayne Mullin signed it with a release date of 31 July 2026. The Federal Register notice followed on 30 October 2026.
DHS gives one reason: Acronis tools hold privileged or root access to customer systems. The signed order names no vulnerability, breach or misuse by Acronis. It binds US federal civilian agencies, not private companies. Below, we explain how such an order works, who has to act and what a company that runs Acronis can sensibly check.
What Is a FASCSA Order?
A FASCSA order is a US government ban on a supplier’s technology in federal buying, federal systems or both. An exclusion order stops new purchases. A removal order makes agencies take out what they already run. This one does both.
The 2018 law set up the Federal Acquisition Security Council, which includes OMB, GSA, DHS, the intelligence community, Justice, Defense and Commerce. The Council recommends; the order comes from DHS for civilian agencies, Defense for its own and national security systems, and the Director of National Intelligence for intelligence systems. The Acronis order is a DHS order, so it covers civilian agencies only.
- Order.
- Exclusion and Removal Order #2026-02.
- Legal basis.
- FASCSA, 41 U.S.C. 1321-1328, and 41 CFR part 201-1.
- Signed by.
- Markwayne Mullin, Secretary of Homeland Security.
- Original release date.
- 31 July 2026.
- Published.
- Federal Register, 30 October 2026, docket DHS-2026-0694.
- Covers.
- Acronis AG, all affiliates and the covered articles they supply.
- Removal clock.
- 180 calendar days from issuance.
Who Has to Act Under the FASCSA Order, and by When
The order speaks to federal civilian agencies. A federal acquisition clause carries part of it to contractors. Everyone else is outside its reach. The table shows each group side by side.
| Who | What applies | Deadline |
|---|---|---|
| Federal civilian agencies. | Exclude Acronis covered articles from all ongoing and future buying. | At once after issuance. |
| Federal civilian agencies. | Remove Acronis covered articles from agency systems, or seek an exception. | 180 calendar days after issuance. |
| Agencies asking for an exception. | Written request to DHS with a justification and any other risk controls. | 60 days after issuance. |
| Contractors running agency systems. | Systems they operate for an agency count as federal systems. | Same as the agency. |
| Federal contractors under FAR 52.204-30. | No covered article in contract work once the order applies to the contract. | From the amendment or modification that adds it. |
| National security and SCI systems. | Outside this order. | None. |
| Companies with no federal work. | Outside this order. | None. |
The order counts both clocks from “the issuance of the Order” but prints no end date. Its first page gives an original release date of 31 July 2026. Counting from that date, the 60-day exception window closed on 29 September 2026. The 180-day removal deadline falls on 27 January 2027.
Those two dates are our own count. If DHS treats a later date as the issuance, both move.
What the Signed Order Says About Acronis
The risk summary in the signed order is two sentences long. It describes Acronis AG as “a foreign, privately-owned company with U.S. subsidiaries” that sells backup, data protection, file sharing and disaster recovery. It then says: “Acronis’s cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems.”
DHS acted on a recommendation from the Federal Acquisition Security Council and “affiliated evidence,” per the notice. Neither document publishes that evidence. The scope is wide: Acronis AG, every affiliate under the FAR definition, and any covered article they supply directly or indirectly. The notice text also names products developed by Acronis SCS and Acronis, Inc.
“Covered article” comes from 41 U.S.C. 4713. It spans IT and cloud services of all types, telecom gear and services, and hardware or software with embedded IT. The order lists no product names, so it reaches every Acronis product and service.
Agencies that cannot remove everything in time may ask DHS for an exception. A request needs a compelling reason and “any alternative mitigations.” Until removal, the order encourages agencies to watch traffic in and out, add logging, control data exfiltration and flag anomalous activity. CISA may give technical help to agencies that lack the skills to comply.
How Acronis Responded
An Acronis spokesperson told Federal News Network that the order “only applies to U.S. federal agencies.” The spokesperson added: “This does not affect our customers and partners.” The company said it continues to work with US agencies “to address any concerns that they may have.”
This is not the first FASCSA step on Acronis. The same report says the Director of National Intelligence banned Acronis from intelligence community buying and systems last year. Acronis called the DHS step “expected as part of the original FASCSA order issued on May 19, 2025.”
Why a Backup Agent Counts as a Supply Chain Risk
A backup agent has to read every file it protects, and often has to write them back. Acronis’s own documentation on the agent logon account shows what that takes on Windows. By default, the agent runs under the Local System account. A custom account must sit in the Administrators and Backup Operators groups, and in Domain Admins on a domain controller.
That is normal for this class of product, not a flaw. It does mean the agent, its updates and its management console form one path into every protected machine. Whoever controls that path, through the vendor or a stolen console login, inherits the access. This is our reading of the risk DHS names; the order gives no technical detail.
- Vendor update channelDelivers new agent builds to every installRun byThe vendor
- Management consoleSends backup plans and commands to agentsRun byThe vendor’s cloud or your own server
- Agent service on each machineReads and restores every protected fileRun byYour hosts, Local System by default on WindowsWhere root access sits
- Protected servers and laptopsYour data, credentials and domain trustRun byYour teams
Each layer trusts the one above it. A review should cover all four, not only the agent.
We saw a similar pattern in October in the ConnectWise supply chain attack, where an actor used a trusted cloud app’s credentials. Our supply chain attack glossary entry explains the wider class.
A Federal Agency and a Private Company Side by Side
The same product can carry a legal duty in one place and none in another. This is how the order lands on each.
| Question | Federal civilian agency | Private company, no federal contract |
|---|---|---|
| Can it buy Acronis | No, from issuance | Yes, the order does not apply |
| Must current installs go | Yes, within 180 days or by exception | No |
| What does the order ask meanwhile | Watch traffic, log more, control exfiltration | Nothing |
| A sensible next step | Plan the move and any exception request | Review the agent like any privileged vendor |
If you hold a federal contract, the line moves. FAR 52.204-30 bars contractors from providing or using a covered article in contract work once a DHS FASCSA order applies. An order issued after the solicitation applies only once an amendment or modification adds it. Contractors must still check SAM.gov at least every three months and report a covered article within 3 business days.
Five Checks for Companies That Run Acronis
None of these steps assume Acronis did anything wrong. They are the review any tool with root access should get, from backup to remote management.
- List every Acronis agent: servers, laptops, virtual hosts and cloud workloads. Include agents a managed service provider installed for you.
- Note the account each agent runs as. Local System or a domain admin account needs a named owner and a review date.
- Check who can sign in to the management console, whether sign-in needs a second factor, and where the console is hosted.
- Limit network reach, so agents talk only to their management server or cloud region. Keep backup copies outside the domain the agents run in.
- Run a fresh vendor review, and record the DHS order in the vendor file. Our vendor cyber risk questionnaire template has questions you can reuse.
Regulated firms and federal suppliers should also ask their regulator or contracting officer what they expect. Our supply chain and vendor risk use case and third-party risk management glossary entry cover the program around these checks. For ongoing checks between reviews, see our third-party risk management platform.
What DHS Has Not Said Yet
DHS has not published the Council’s recommendation or the evidence behind it. The order names no product, version or incident. The Secretary must review the order within one year and every year after that. We will update this post if DHS, CISA or Acronis adds detail.