Civilian federal agencies have 180 days to tear Acronis backup and cybersecurity software out of their networks, and they can no longer buy it, under a Department of Homeland Security order that Federal News Network reported on Oct. 28. Homeland Security Secretary Markwayne Mullin signed the exclusion and removal order against Swiss firm Acronis AG, which is dated July 31, 2026, but DHS is only now releasing it publicly. A notice of the order, FR Doc. 2026-22215 under DHS Docket DHS-2026-0694, is scheduled for Federal Register publication on Oct. 30.
The order extends to the civilian side of government a ban that the intelligence community imposed last year. It follows by about a week a similar DHS order against Chinese artificial intelligence firm DeepSeek.
What the Acronis Order Requires of Civilian Agencies
The order has two parts. According to Federal News Network, it "directs agencies to exclude Acronis AG and its affiliated entities, as well as any products directly or indirectly supplied by them, from all ongoing and future procurement actions." It also directs agencies to remove Acronis products from their information systems within 180 calendar days.
The Federal Register notice describes the same scope in its summary. DHS, it says, "is publishing notice of the Secretary of Homeland Security's issuance of an order excluding Acronis AG and all affiliated entities, as well as any covered articles directly or indirectly supplied by them (Acronis covered articles) from federal civilian agency procurements; and, removing all Acronis covered articles from civilian agency information technology systems."
The notice's supplementary information names the corporate entities more precisely. It covers information technology products developed by Acronis, Inc., Acronis SCS, and affiliated entities as defined in 48 C.F.R. 2.101, the Federal Acquisition Regulation's definitions section. The exclusion applies to federal civilian executive branch procurements, and the removal applies to federal civilian executive branch IT systems.
The "directly or indirectly supplied" language matters. An agency that never contracted with Acronis may still run its software if the product came bundled through a reseller, an integrator, or a managed service provider, and the order's wording appears to reach those paths as well.
Why DHS Says Backup Tools With Root Access Are a Risk
The order offers the most specific public explanation yet of what worries U.S. officials about the company. In a "summary of risks," the order states that "Acronis's cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems," according to Federal News Network.
The document does not elaborate further. Root access in IT is an administrative privilege that grants virtually unlimited access to a system's programs, files and resources. Backup and data protection software typically needs that level of access to copy and restore whole systems, which helps explain why a supply chain concern about such a product could lead to an exclusion order rather than a configuration fix.
The intelligence community's directive last year gave no comparable detail about the underlying security concerns, Federal News Network reported.
How FASCSA Built the Case Against Acronis
DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. 1321-1328, and its implementing regulations at 41 CFR 201-1. The Federal Register notice says the Secretary acted "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence."
Acronis has been on this path before. The director of national intelligence banned Acronis from intelligence community procurements and information systems last year, at the recommendation of the Federal Acquisition Security Council. That order was the first removal and exclusion order issued under FASCSA. An Acronis spokesperson dated it to May 19, 2025. The General Services Administration also removed Acronis products and services from its multiple award schedules last year.
The DHS order now covers the civilian agencies that sit outside the intelligence community's authority.
Acronis Says the Ban Does Not Touch Commercial Customers
Acronis framed the order as expected and narrow. "The DHS published an exclusion order that was expected as part of the original FASCSA order issued on May 19, 2025," an Acronis spokesperson told Federal News Network. "The DHS exclusion order only applies to U.S. federal agencies and was originally signed and published on July 31, 2026. This does not affect our customers and partners. We continue to work with the U.S. government agencies to address any concerns that they may have."
Acronis AG was founded in 2003 in Singapore and is headquartered in Switzerland. Its U.S. subsidiaries provide data protection, data backup, secure file sharing and disaster recovery products. Earlier this month the company named Gerald Caron, a former chief information security officer at the International Trade Administration, as its new chief information security officer.
How Much Acronis Software Do Agencies Actually Run?
Federal News Network calls the extent of Acronis use within federal systems and contracts unclear. Acronis has not been awarded a federal contract since fiscal 2016, according to USASpending.gov, as cited by the outlet. But the company sells through a network of resellers and partners, which makes it difficult to track how widely federal agencies, contractors and subcontractors have used its products.
That gap is where the 180-day clock is likely to bite. Agencies will need to inventory backup agents, endpoint protection and disaster recovery tools that may have arrived through third parties, then migrate data and retention schedules to replacement products before the deadline.
What It Means for Contractors
Resellers and integrators that offer Acronis products on civilian contracts face the most direct effect. The order bars Acronis covered articles from "all ongoing and future procurement actions," so pending quotes and task orders that include Acronis software look likely to be off the table for civilian agencies. Companies that resell to both commercial and government buyers should separate their federal offerings now.
Managed service providers and cloud backup vendors should check whether any Acronis component sits inside the services they deliver to agencies. Because the order reaches products "directly or indirectly supplied," a white-labeled or embedded Acronis engine inside another product could still count. Vendors should be ready to document the components in what they sell.
The removal deadline also creates near-term work. Agencies that discover Acronis deployments will need replacement backup and data protection tools, migration support and validation that restored data remains intact. Vendors with FedRAMP-authorized backup products and migration services may be well placed to compete for that work.
Contractors with questions about implementation can contact the FASCSA Order Implementation Team in CISA's Cybersecurity Division at [email protected], the contact listed in the Federal Register notice. The signed order itself is posted in Docket DHS-2026-0694 on regulations.gov.
