PF 2027-04 Notice of Order Regarding Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems and Procurements
DATE: November 9, 2026
TO: HCAs/Senior Contracting Partners/Contracting Officers
FROM: Director, Contract and Financial Assistance Policy Division, Office of Policy, Office of Acquisition Management
SUBJECT: Notice of Order Regarding Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems and Procurements.
SUMMARY: This Policy Flash (PF) informs Department of Energy (DOE) and National Nuclear Security Administration (NNSA) contracting personnel of the issuance of Federal Acquisition Supply Chain Security Act (FASCSA) Exclusion and Removal Order #2026-02 by the Department of Homeland Security (DHS).
Acronis, AG (hereinafter Acronis), a foreign, privately-owned company with U.S. subsidiaries, provides data protection, data backup, secure file sharing, and disaster recovery solutions (on premises and via the cloud). Acronis's cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems.
Pursuant to the authority granted by the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328, and implementing regulations at 41 CFR 201-1, following review of the Federal Acquisition Security Council recommendation and affiliated evidence, the Secretary of Homeland Security has ordered: (1) the exclusion of Acronis covered articles from all ongoing and future procurements effective immediately after issuance of this Order, to include agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services; and (2) the removal of all Acronis covered articles from all agency information systems within 180 calendar days of the issuance of the Order, or seek an Exception, as described below. (Federal Register Docket DHS-2026-0694; FR Doc. 2026-22215). FASCSA orders are a type of supply chain security order governed by the Federal Acquisition Supply Chain Security Act of 2018 and the Federal Acquisition Security Council final rule for complying with exclusion or removal orders and sharing certain supply chain risk information. The Council determined that software agents, backup engines, and data recovery tools associated with Acronis pose an unacceptable supply chain risk to executive branch systems due to their architectural requirement for deep, persistent, and root-level administrative access across host infrastructure.
As a result of this order, effective immediately, DOE offices are directed to remove all Acronis products from their information systems and may not enter into contracts which include Acronis products or services. All covered articles must be identified, isolated, and completely removed from civilian agency systems by January 27, 2027.
Further information on the scope, product coverage, and other requirements and stipulations of this order can be found in Attachment 1 - - FASCSA 2026-02 Acronis Removal and Exclusion Order, as well as online on the Federal Register at https://www.federalregister.gov/documents/2026/10/30/2026-22215/notice-of-order-regarding-exclusion-and-removal-of-acronis-products-from-federal-civilian-executive.
Waivers under FASCSA are reserved solely for emergency mission circumstances where security risks are mitigated by robust compensating controls. Any formal waiver package must be sponsored by the relevant HCA, endorsed by the Department CIO and General Counsel, and authorized by the Secretary of Energy before submission to DHS and the FASC for formal adjudication.
Questions concerning this policy flash should be directed to the Contract and Financial Assistance Policy Division at DOE_oapmpolicy@hq.doe.gov.
For NNSA questions concerning this policy flash, please contact Acquisition Policy and Oversight Division, Policy & Oversight Branch (NA-PAS-111), at (505) 845-5639.
Questions regarding the general technical requirements and scope of the order should be directed to FASCSA.Orders@cisa.dhs.gov. For questions related to DOE-specific systems, please contact IM-20_Policy@hq.doe.gov.