Binding Operational Directives

BOD 26-02: Mitigating Risk From End-of-Support Edge Devices

February 05, 2026

Background

The United States faces persistent cyber campaigns that threaten both public and private sectors, directly impacting the security and privacy of the American people. These campaigns are often enabled by unsupported devices that physically reside on the edge of an organization’s network perimeter. Unsupported devices – referred to in this Directive as “end of support (EOS)” – are those that are no longer maintained by their vendors.

The imminent threat of exploitation to agency information systems running EOS edge devices is substantial and constant, resulting in a significant threat to federal property. CISA is aware of widespread exploitation campaigns by advanced threat actors targeting EOS edge devices. Recent public reports of campaigns targeting certain vendors highlight actors' attempts to use these devices as a means to pivot into FCEB information system networks. Edge devices are attractive targets due to their extensive reach into an organization's network and integrations with identity management systems. These devices are especially vulnerable to cyber exploits targeting newly discovered, unpatched vulnerabilities. Additionally, they no longer receive supported updates from the original equipment manufacturer, exposing federal systems to disproportionate and unacceptable risks. However, unlike many attack vectors, this can be remediated by agencies following proven lifecycle management practices as outlined in the required actions of this Directive.

This Binding Operational Directive, developed in coordination with OMB, implements OMB policy on phasing out unsupported information systems and information system components. BOD 26-02 specifically addresses EOS devices deployed on the “edge” or public-facing areas of federal networks, exposed to external environments such as the internet. However, EOS devices should not reside anywhere on federal networks. This Directive aligns with OMB’s Circular A-130¹, Managing Information as a Strategic Resource, which establishes policy for the management of federal information resources, emphasizing security, privacy, and the efficient use of resources throughout their lifecycle. A-130 requires that “unsupported information systems and system components are phased out as rapidly as possible, and planning and budgeting activities for all IT systems and services incorporate migration planning and resourcing to accomplish this requirement.”² Agencies should mature their lifecycle management practices to identify hardware and software nearing their EOS dates, plan for timely replacements, procure vendor-supported alternatives, and develop a plan for decommissioning EOS devices while minimizing disruptions to agency operations. Agencies that do not maintain appropriate lifecycle management processes for edge devices have a greater risk of compromise and an increased overall risk associated with EOS technology.

To support agencies in the initial identification of EOS devices, CISA developed an EOS Edge Device List. This preliminary repository provides information on devices that are already EOS or soon-to-be EOS. This Directive requires federal agencies to use this information to identify and remediate vulnerabilities within the first three months of Directive issuance. This Directive also specifies long-term requirements for managing EOS edge devices across all federal networks.

As agencies plan for technical refreshes of edge devices, they should keep in mind the requirements of OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles.³ That memorandum directs agencies to take important actions related to:

Multifactor authentication (MFA),
Asset management and identification,
Isolation of critical workloads and strong access policy, and,
Encryption of data in transit.

These elements should not be considered a complete list. Additional information and guidance can be found in NIST 800-207,⁴ CISA’s TIC 3.0 Capability Catalog,⁵ and CISA's Zero Trust Maturity Model.⁶

Definitions

End of Support: Hardware devices, firmware, and software versions that no longer receive timely, supported updates from the original equipment manufacturer, including patches for CVEs, security updates, software fixes (hotfixes), and defects.
Edge Devices: All technology devices that reside on the boundary of an agency’s network and are accessible from the public internet. (This includes but is not limited to load balancers, firewalls, routers, switches, wireless access points, network security appliances, IoT edge devices, software defined networks and other physical or virtual networking devices that are responsible for routing network traffic and provide privileged access.)

Scope

This Directive applies to all devices residing on or supporting federal information systems and/or networks that meet the following criteria:

Is an edge device that operates as a component⁷ of an information system⁸ owned or operated by, or on behalf of, an agency,
Is considered by its vendor or CISA to be EOS, and,
Is physically or logically located on an agency’s network boundary.

This Directive refers to the systems to which it applies as “Federal Civilian Executive Branch” (FCEB) systems, and to agencies operating those systems as “Federal Civilian Executive Branch” (FCEB) agencies. This Directive applies to all federal information systems managed on agency networks or hosted by third parties on an agency’s behalf. This Directive applies to FCEB agencies, not contractors, but FCEB agencies may need to modify contracts to comply with the requirements of this Directive. This Directive does not apply to Operational Technology⁹ devices and FedRAMP authorized cloud computing products and services defined as “out of scope” by OMB Memorandum M-24-15.¹⁰

Required Actions

Immediately after issuance, and until rescinded or superseded, all FCEB agencies shall:

Update each vendor supported edge device running EOS software, including firmware, to a vendor-supported software version, where such an update does not adversely impact mission critical functionality.

Within three (3) months of issuance, all FCEB agencies shall:

Inventory all devices listed in the CISA EOS Edge Device List and provide this inventory to CISA using the CISA-provided template.

The CISA EOS Edge Device List is a preliminary repository of EOS devices. This list is to facilitate each agency’s identification of specific devices within the first three months after issuance of this Directive. After the first three months, agencies are responsible for continuing to identify, track, and refresh all edge devices within the agency’s infrastructure (see requirements #5-9).

Within twelve (12) months of issuance, all FCEB agencies shall:

Decommission all identified devices listed in the CISA EOS Edge Device List with an EOS date on or before this twelve-month deadline from systems owned or operated by agencies, or on behalf of an agency, replacing devices as needed with vendor-supported devices that can receive security updates.
Report these decommissions to CISA using the CISA-provided reporting template.
Inventory all edge devices within their environments that are EOS or will become EOS within the succeeding twelve months and are within the scope of this Directive and provide this inventory to CISA using the CISA-provided template.

Within eighteen (18) months of issuance, all FCEB agencies shall:

Decommission all identified EOS edge devices from agency networks, replacing devices as needed with vendor-supported devices that can receive current security updates.
Report these decommissions to CISA using the CISA-provided reporting template.

Within twenty-four (24) months of issuance, all FCEB agencies shall:

Establish a process for continuous discovery of all edge devices within their environments and maintaining an inventory of those that are EOS or will become EOS within twelve months and are within the scope of this Directive.
Have decommissioned such devices on or before the date these devices reach EOS; and report the decommission of these devices to CISA in accordance with current CISA guidance.

CISA Actions:

CISA will provide an initial list of EOS and soon-to-be EOS edge devices for Required Actions #2 and #3. This list will include the IT product name, version number, and end of support date.
CISA will evaluate ways to automate ingestion of discovery and reports for agencies and provide a solution that allows for automated, machine-readable submissions.
As necessary following the issuance of this Directive, CISA will review this Directive to account for changes in the general cybersecurity landscape and consider issuing Supplemental Direction to incorporate additional best practices for federal information systems.
Within fifteen (15) months of Directive issuance, CISA will assess agency progress and submit a status report to the Secretary of Homeland Security, the Director of the Office of Management and Budget (OMB), and the National Cyber Director outlining performance indicators, lingering issues, and cross-agency status in implementing the Directive.