CISA Orders Removal of Unsupported Edge Devices to Reduce Federal Network Risk

CISA issued Binding Operational Directive 26-02 requiring FCEB agencies to mitigate risks from unsupported edge devices by immediately updating vendor-supported software, cataloging all devices within 3 months, decommissioning listed end-of-support edge devices within 12 months and all other identified unsupported devices within 18 months, and establishing a lifecycle management process within 24 months. The directive targets load balancers, firewalls, routers, switches, WAPs, IoT edge devices, and similar components, aiming to cut technical debt and reduce exploitation by persistent state-sponsored actors.