CISA gives federal agencies one year to rip out end-of-life devices

CISA issued an operational directive ordering federal civilian agencies to inventory and remove end-of-life edge devices within 12 months after observing substantial, ongoing exploitation campaigns. The agency cited persistent exploitation of unsupported firewalls, routers, switches, load balancers and IoT/network edge appliances—including activity tied to nation-state actors—and requires agencies to submit inventories within three months, decommission identified devices within a year, and implement continuous discovery processes while assisting compliance.