DHS Orders Removal of Swiss Cyber Firm Acronis from Federal Networks

Key points

• DHS published an exclusion and removal order for Acronis AG, effective for civilian agencies, scheduled for the Federal Register on October 30, 2026.
• The order mandates the removal of Acronis products from agency information systems within 180 calendar days and bans all future procurement actions involving the company or its affiliates.
• DHS cited a 'summary of risks' stating that Acronis's cyber and backup tools possess privileged or root access to customer security systems, posing significant risks to U.S. government information systems.
• This action follows a 2025 exclusion by the director of national intelligence, which was the first removal order issued under the Federal Acquisition Supply Chain Security Act, and a subsequent removal by the General Services Administration.
• Acronis, founded in 2003 and headquartered in Switzerland, has not won a direct federal contract since fiscal 2016, but its products may be present in systems via resellers and partners.

Background

This ban is part of a broader trend of U.S. restrictions on foreign technology perceived as security risks. In late 2026, DHS similarly banned Chinese AI firm DeepSeek from civilian federal networks, citing data security concerns. Additionally, the U.S. has recently restricted imports from Chinese genomics firm BGI over human rights allegations. These actions reflect heightened scrutiny of supply chain security and foreign influence in critical infrastructure and data protection sectors.

Why it matters

The ban highlights the U.S. government's expanding definition of cybersecurity threats to include foreign vendors with deep system access, even if they are not state-owned. It signals that 'root access' capabilities in backup and recovery tools are now viewed as critical vulnerabilities. For federal agencies, this necessitates a rapid audit and migration of data protection infrastructure, potentially disrupting disaster recovery plans. It also underscores the difficulty of tracking indirect usage through resellers, complicating compliance efforts for contractors and subcontractors.

What to watch

Federal agencies must comply with the 180-day removal deadline, requiring them to identify and replace Acronis products within their networks. Acronis has stated it continues to work with U.S. agencies to address concerns, though the ban applies only to federal entities. The company recently appointed Gerald Caron, a former chief information security officer at the International Trade Administration, as its new CISO, which may influence future engagement with U.S. officials.