CISA Orders Removal of Unsupported Active Network Edge Devices to Reduce Security Risks

CISA issued BOD 26-02 directing Federal Civilian Executive Branch agencies to inventory and remove end-of-support edge devices (e.g., firewalls, routers, VPN gateways, load balancers) on a strict 3–24 month schedule and to establish continuous lifecycle management; the directive addresses the elevated risk posed by unsupported, internet-facing infrastructure that can be exploited to pivot into networks and steal credentials, aligns with Zero Trust and OMB A-130 requirements, and includes CISA-provided guidance, reporting templates, and an evolving EOS device list, while urging state/local governments, critical infrastructure, and private organizations to follow suit.