Update: DHS Extends Acronis Exclusion and Removal to Civilian Agencies
WHAT: The U.S. Department of Homeland Security (DHS) recently published a notice of an Acronis exclusion and removal order under the Federal Acquisition Supply Chain Security Act (FASCSA). The order establishes restrictions for federal civilian agency procurements and information systems, including systems operated by contractors or other organizations on an agency’s behalf.
As discussed in our earlier alert, the Director of National Intelligence (DNI) issued an order in September 2025 excluding Acronis from Intelligence Community (IC) procurements and requiring removal of Acronis covered articles from IC and sensitive compartmented information systems. The U.S. General Services Administration (GSA) also announced in September 2025 that it had removed Acronis products and services from GSA Advantage and would remove them from Multiple Award Schedule contracts.
DHS’s new order establishes a separate civilian agency exclusion and removal requirement under DHS’s own FASCSA authority. The order also provides a public explanation of the risks prompting this action, including the privileged or root access that Acronis cybersecurity and backup tools have to customer systems. That access gives the tools extensive visibility into and control over the systems they protect.
WHEN: The signed DHS order identifies July 31, 2026, as its original release date, but the public notice was published on October 30. It directs immediate exclusion from ongoing and future procurements, removal from covered systems within 180 calendar days of issuance, and submission of agency exception requests within 60 days of issuance. Those periods run from issuance of the signed order. Thus, measured from July 31, the exception request period had already elapsed before publication of the public notice.
WHAT DOES IT MEAN FOR INDUSTRY: The DHS order adds a civilian agency implementation requirement to the earlier IC restrictions and GSA action. It expressly covers systems operated on an agency’s behalf, while its coverage of indirectly supplied articles reaches Acronis products obtained through intermediaries, including resellers.
Scope
Both orders extend beyond Acronis AG. The earlier DNI order covered subordinate, subsidiary, and affiliated organizations doing business in support of Acronis. DHS’s order specifically identifies Acronis, Inc. and Acronis SCS, and it also covers articles supplied directly or indirectly by Acronis AG or its affiliates, as defined in FAR 2.101.
Agency Deadlines and Exceptions
The published DHS order provides implementation details that the public DNI listing discussed in our earlier alert did not disclose. Agencies seeking an exception were required to submit a written request within 60 days of issuance, supported by a compelling justification and alternative mitigations. DHS could approve or disapprove the request in writing.
The 180-day removal period is the agency implementation deadline. The order also encourages interim measures while agencies implement removal, including enhanced logging, monitoring for data exfiltration, and anomaly detection. These recommendations supplement the exclusion and removal requirements; the order describes them as encouraged interim protections.
Contractor Responsibilities
Contractor obligations in response to the DHS order depend on applicable contract terms and implementation actions. Under the basic version of FAR 52.204-30 and RFO FAR 52.240-91, DHS orders apply to non-DoD solicitations and contracts issued after the order is made public. For previously issued solicitations and contracts, the order applies only if incorporated through an amendment to the solicitation or modification to the contract.
The clauses separately require a reasonable inquiry when a contractor identifies a new FASCSA order that could affect its supply chain. If that inquiry identifies covered products or services provided to the Government or used in contract performance (including products or services provided by a subcontractor), FAR 52.204-30 requires the contractor to provide an initial report to the Government within three business days of identification or notification, followed by additional information within 10 business days after the initial report, whereas RFO FAR 52.240-91(i)(3) requires an initial report within 72 hours. Contractors also may not provide Acronis products or services to the Government, or use them in performance of civilian agency contracts, going forward.
Wiley’s cross-disciplinary Government Contracts, National Security, Cybersecurity, and Artificial Intelligence (AI) teams will continue to monitor these developments and advise clients on compliance issues related to the DHS FASCSA Order and future FASCSA Orders.
* * * *
