The Department of Homeland Security has published an order excluding covered Acronis products from federal civilian executive branch procurement and requiring their removal from agency information systems. The October 30 Federal Register notice attaches Order 2026-02, which lists July 31, 2026 as its original release date.
What the order covers
The order directs civilian executive agencies to exclude Acronis AG and affiliated entities, along with covered articles supplied directly or indirectly by them, from procurement actions. It also directs removal of those covered articles from agency information systems.
The attached order's stated application excludes national security systems and secure compartmented information systems. Its system coverage includes federal information systems used or operated by an agency contractor or another organization on an agency's behalf.
This is a federal procurement and agency-systems order. It does not impose a general ban on consumers using Acronis software.
The clock runs from issuance
Procurement exclusion takes effect immediately after issuance and covers ongoing and future procurement. Removal must occur within 180 calendar days of issuance, or the agency must seek an exception.
Written exception requests must be submitted within 60 days of issuance. They must identify the order, give a name or description sufficient to identify the covered article or the product or service from a source subject to the order, describe the exception sought, provide a compelling justification and describe alternative risk mitigations. DHS says it will provide written approval or disapproval.
Those are the order's intervals. The October 30 notice does not restart them, and no calendar compliance deadline is calculated here from its publication date.
Risk assessment and limits
The order says Acronis cyber and backup tools have privileged or root access to customer security systems and present a significant risk to U.S. government information systems. That is the government's assessment; the underlying evidence was not examined here.
During the period before full removal, the order encourages agencies to monitor traffic, enhance logging and detect anomalous activity. The published document does not establish which agencies have removed products or obtained exceptions, or identify an actual breach.