# DHS Orders Civilian Agencies to Drop Acronis Products Within 180 Days

- URL: https://usa-24.com/acronis-federal-ban-dhs-order/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-01T02:25:09.050Z
- Updated: 2026-11-01T02:25:09.056Z
- Topics: Acronis, DHS, FASCSA, Supply Chain Security, Federal Procurement

> DHS has ordered federal civilian agencies to remove Acronis products within 180 days, citing privileged access to customer systems.

## Key takeaways

- DHS ordered federal civilian agencies to stop buying Acronis products and remove them from their networks within 180 days.
- The order was signed July 31, 2026 by DHS Secretary Markwayne Mullin, and the Federal Register notice is dated October 30 under docket DHS-2026-0694.
- DHS's summary of risks says Acronis's tools provide privileged or root access to customer security systems, and the order cites no confirmed compromise.
- The order extends a 2025 intelligence community ban on Acronis and follows a similar DHS action against DeepSeek the previous week.
- Consumers and most commercial customers are not directly covered, while a possible FCC Covered List action remains unresolved.

The Department of Homeland Security has ordered federal civilian agencies to stop buying Acronis products and remove them from their networks within 180 days. The order was signed July 31 by DHS Secretary Markwayne Mullin, but it became public this week, and the Federal Register notice is dated October 30. For the agencies and contractors that depend on Acronis software, the Acronis federal ban is now a deadline on the calendar.

Few readers outside federal IT have heard of Acronis. The company was founded in 2003 and is headquartered in Switzerland, and it sells backup and security software largely through resellers and partners. The order is also the second major DHS supply-chain action in about a week, following a similar exclusion and removal order against DeepSeek.

## Which agencies must remove Acronis and by when

The order applies to federal civilian executive branch agencies. It gives them 180 calendar days to remove Acronis products from their information technology systems. It also bars agencies from buying Acronis products in the future, including through approved product lists and online marketplaces, according to the [Federal Register notice](https://www.federalregister.gov/documents/2026/10/30/2026-22215/notice-of-order-regarding-exclusion-and-removal-of-acronis-products-from-federal-civilian-executive). The notice is filed under docket DHS-2026-0694 and published as 91 FR 68528.

The coverage extends to Acronis AG, the Swiss parent, and its affiliates. The named affiliates include the U.S. companies Acronis Inc. and Acronis SCS, so the order reaches American operations as well as the Swiss headquarters.

The start date is the key unknown. The sources reviewed do not say whether the 180 days run from the July 31 signing or from publication on October 30. If the clock started July 31, the deadline falls around January 27, 2027. That date is my own arithmetic, not a figure DHS has published, so agencies should confirm the start date through official channels before they set internal deadlines.

## Why DHS says Acronis is a security risk

The order is the first action in this chain to give a public security reason. The Director of National Intelligence's 2025 order gave none. According to [Federal News Network](https://federalnewsnetwork.com/cybersecurity/2026/10/dhs-bans-swiss-cyber-firm-from-federal-systems/), the DHS summary of risks says Acronis's tools provide "privileged or root access to customer security systems."

That phrase explains the logic. Backup and security agents often run with deep permissions, and a vendor with root access could reach nearly everything it protects. The concern is access and exposure, not a documented breach. Reporting on the order says it identifies neither a specific flaw nor a confirmed compromise, as [Mallory's coverage](https://mallory.ai/stories/01a18eb2-a80a-797c-8982-ed680436f0a2) notes.

A separate thread complicates the picture. On September 16, 2026, CISA added an Acronis Backup flaw, CVE-2026-87886, to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog). Catalog listings signal that CISA has evidence of exploitation in the wild. The flaw involves incorrect default permissions, and the DHS order does not appear to rely on it. No source confirms a connection between the two, so readers should treat them as separate matters.

Vendor-level risk of this kind is not new. USA 24 has reported on a [Cisco SD-WAN flaw](https://usa-24.com/cisco-sd-wan-vulnerability-keydrift/) that was used to steal encryption keys, a reminder that management software sits at the center of enterprise trust.

## How the order builds on the 2025 intelligence ban

The Acronis action did not start with this order. The Director of National Intelligence issued the first Federal Acquisition Supply Chain Security Act (FASCSA) exclusion and removal order against Acronis AG in 2025, covering intelligence community systems, as [Mayer Brown](https://www.mayerbrown.com/en/insights/publications/2025/10/dni-issues-first-fascsa-exclusion-and-removal-order-against-acronis-ag) explained. The DHS order extends that ban to civilian agencies.

FASCSA addresses the risk that vulnerabilities in the information and communications technology supply chain could compromise federal systems. Its roots trace to a 2017 DHS directive that barred agencies from using Kaspersky products. The Federal Acquisition Security Council recommended the DHS action, according to [Vital Law](https://www.vitallaw.com/news/citing-security-concerns-dhs-bans-swiss-tech-firm-from-federal-networks/cspd01c9fd5f5f1723476594cb69849f0e4f42).

The General Services Administration moved earlier. It removed Acronis products from GSA Advantage in September 2025 and reminded contractors of their obligations under FAR 52.204-30. According to USAspending.gov, Acronis has not won a federal contract since fiscal 2016. That history suggests its direct federal revenue is small, even though the order's reach through partners is harder to size.

The timeline so far looks like this:

| Date | Event |
|---|---|
| 2025 | DNI issues the first FASCSA exclusion and removal order against Acronis AG for intelligence community systems |
| September 2025 | GSA removes Acronis products from GSA Advantage |
| July 31, 2026 | DHS Secretary Markwayne Mullin signs the civilian agency order |
| September 16, 2026 | CISA adds CVE-2026-87886 to its Known Exploited Vulnerabilities catalog |
| October 30, 2026 | Federal Register notice published under docket DHS-2026-0694 |
| About January 27, 2027 | Derived 180-day deadline if the clock starts July 31 |

## What the Acronis federal ban means for contractors and IT teams

Federal civilian IT staff carry the heaviest workload. Agencies must inventory Acronis deployments, then plan removals or request exceptions. Contractors face a second layer. They are bound by FAR 52.204-30, must monitor FASCSA orders and must notify contracting officers, according to law-firm guidance on the order.

For anyone in that position, a practical sequence looks like this:

- Inventory every Acronis deployment, including endpoint agents, server installs and backup targets, and record who owns each one.
- Review contracts, renewals and procurement requests, and stop any new orders, including items listed on approved product lists or marketplaces.
- Map replacement options and test them against current backup and recovery requirements before the removal window closes.
- If a mission need requires continued use, document it and request an exception through the agency's official channel rather than delaying removal.
- Contractors should notify their contracting officers about FASCSA exposure and track any further orders.

Managed service providers deserve their own check. Acronis sells mostly through partners, so an MSP that resells the product may have government-facing customers to review. It is also unclear how widely civilian agencies use Acronis, because much of that usage flows through resellers.

## Who is and is not covered by the Acronis federal ban

Consumers and most commercial customers are not directly covered, according to reporting and Acronis's own statement. An unnamed Acronis spokesperson told Federal News Network that "The DHS exclusion order only applies to U.S. federal agencies." The company also said it continues working with federal agencies on their concerns.

A business using Acronis outside government work does not appear to face a federal removal requirement under this order. The Federal Communications Commission is the wildcard. Several law firms warned that the orders could lead the FCC to place Acronis on its Covered List, which would block new equipment authorizations. Whether the FCC will act is unknown, so for now it is a risk to monitor rather than a reported action.

## What to watch next in the Acronis case

Several open questions will shape the coming months. DHS has not cited a specific Acronis vulnerability or a confirmed compromise, and the order identifies neither. The FCC has not said whether it will add Acronis to its Covered List. Agencies will need to report progress against the removal window, and DHS will need to clarify when that window starts.

Acronis's legal options have not been reported, and its public response has been limited to short statements. Its next move, along with any FCC decision, will show how far the restrictions reach beyond federal buyers.

The DeepSeek and Acronis orders suggest DHS is willing to use supply-chain authority in quick succession. Vendors that sell through partners and hold deep access to customer systems should expect similar scrutiny. The first hard date on the calendar is the one agencies must now count down toward, and the Federal Register docket will be the place to watch for changes.

## Frequently asked questions

### Is Acronis banned by the government?

Not in a general sense. DHS has ordered federal civilian agencies to stop buying Acronis products and remove them from their systems within 180 days. Consumers and most commercial customers are not directly covered, according to reporting and Acronis's own statement.

### When does the Acronis removal deadline take effect?

The order was signed July 31, 2026, and the Federal Register notice is dated October 30, 2026. The sources reviewed do not say which date starts the 180-day clock. If it runs from July 31, the deadline would fall around January 27, 2027, a date derived from simple arithmetic rather than published by DHS.

### Why did DHS order the removal of Acronis?

DHS's summary of risks says Acronis's tools provide privileged or root access to customer security systems. The order names neither a specific vulnerability nor a confirmed compromise, and DHS has not publicly cited an incident.

### Does the DHS Acronis order affect businesses that use Acronis?

Only businesses that work with federal agencies face direct obligations. Federal contractors must follow FAR 52.204-30 and notify contracting officers of FASCSA exposure, and managed service providers should check government-facing customers. Other companies should watch for any FCC Covered List action.

## Sources

1. [DHS Orders Civilian Agencies to Purge Acronis Software — BankInfoSecurity](https://www.bankinfosecurity.com/dhs-orders-civilian-agencies-to-purge-acronis-software-a-33264)
2. [Notice of Order Regarding Exclusion and Removal of Acronis Products From Federal Civilian Executive Branch Information Technology Systems and Procurements — Federal Register](https://www.federalregister.gov/documents/2026/10/30/2026-22215/notice-of-order-regarding-exclusion-and-removal-of-acronis-products-from-federal-civilian-executive)
3. [DHS bans Swiss cyber firm from federal systems — Federal News Network](https://federalnewsnetwork.com/cybersecurity/2026/10/dhs-bans-swiss-cyber-firm-from-federal-systems/)
4. [DHS Orders Acronis Products Removed From Federal IT Systems — ExecutiveGov](https://www.executivegov.com/articles/dhs-remove-acronis-products-it-systems)
5. [DNI Issues First FASCSA Exclusion and Removal Order Against Acronis AG — Mayer Brown](https://www.mayerbrown.com/en/insights/publications/2025/10/dni-issues-first-fascsa-exclusion-and-removal-order-against-acronis-ag)
6. [Citing Security Concerns, DHS Bans Swiss Tech Firm From Federal Networks — Vital Law](https://www.vitallaw.com/news/citing-security-concerns-dhs-bans-swiss-tech-firm-from-federal-networks/cspd01c9fd5f5f1723476594cb69849f0e4f42)
7. [CISA Adds Two Known Exploited Vulnerabilities to Catalog (September 16, 2026) — CISA](https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog)
8. [DHS Orders Federal Civilian Agencies to Remove Acronis Software — Mallory](https://mallory.ai/stories/01a18eb2-a80a-797c-8982-ed680436f0a2)