DHS Ordered Acronis Out of Civilian Agencies. Unlike DeepSeek, the Backup Software Gets 180 Days.

Last week I wrote about the first exclusion and removal order DHS has issued under the 2018 supply chain law, the one aimed at DeepSeek. That order told civilian agencies to remove DeepSeek products “immediately after the issuance of the Order” [2]. The second order, published in the Federal Register on October 30, names Acronis, a Swiss data backup and cyber protection company. It gives agencies 180 calendar days [1].

That gap is the most useful thing in the document. You can tell an agency to stop using a chatbot by Friday. You can’t tell it to rip out the software that holds its backups by Friday.

What Order #2026-02 requires

Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order #2026-02 under the Federal Acquisition Supply Chain Security Act of 2018, with OMB Director Russell Vought copied [1]. Its “Original Release Date” is July 31, 2026; the Federal Register notice, Docket No. DHS-2026-0694, ran three months later [1]. It covers federal civilian executive branch agencies, except their national security and sensitive compartmented information systems [1].

The order directs agencies to do two things [1]:

1. Exclude Acronis AG, its affiliates and “any covered articles directly or indirectly supplied by them” from all ongoing and future procurements, effective immediately. That includes approved product lists, service provider equipment lists and e-commerce markets.
2. Remove Acronis covered articles from agency information systems “within 180 calendar days of the issuance of the Order, or seek an Exception.”

Nextgov/FCW puts the removal deadline at January 27, 2027 [5]. Agencies that wanted an exception had to ask in writing within 60 days of issuance, with a “compelling justification” and proposed mitigations [1]. By this column’s count, that window closed September 29, a month before the public notice. DHS, not CISA as in the DeepSeek order, reviews those requests [1, 2]. Until removal is done, agencies are encouraged to monitor traffic in and out, add logging and set “controls on data exfiltration for the relevant systems” [1].

Two definitions do a lot of work. Affiliates use the standard FAR control test [1]. And a footnote says that, consistent with FISMA, the order applies to information systems “used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency” [1].

Why does the Acronis order say so little about the risk?

The risk section is a single paragraph. It calls Acronis “a foreign, privately-owned company with U.S. subsidiaries” that sells data protection, backup, file sharing and disaster recovery, on premises and in the cloud [1]. Then the whole rationale: “Acronis’s cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems” [1].

No country is named. The DeepSeek order cited a privacy policy, a House Select Committee report and a mobile app security analysis [2]. This one cites nothing.

Nextgov/FCW filled in some of the background. Two former officials told it the review ran for years and focused largely on the company’s development ties in Russia, including whether Russian developers remained involved in its codebase; neither said there was concrete evidence of backdoors [5]. The company relied on Moscow-based engineering before suspending Russian operations after the 2022 invasion of Ukraine [5]. An Acronis spokesperson told Nextgov/FCW that EQT took a majority stake on May 15, 2025, with CFIUS approval, and did not say whether the company would challenge the order [5].

This isn’t the first federal order against the company. The Director of National Intelligence issued the very first order under the 2018 law against Acronis, posted to SAM.gov on September 15, 2025, covering intelligence community systems [6]. GSA said three days later that it had pulled Acronis from GSA Advantage [6]. According to Nextgov/FCW, a Defense Department ban also came before the DHS order [5].

What this means if you sell to agencies

This part is opinion.

The word “indirectly” is the part that reaches you. Agencies don’t appear to buy much from Acronis directly. Nextgov/FCW reports that recent government purchases ran mostly through resellers, and that Acronis last won a federal contract directly in 2016 [5]. So the order’s real targets are resellers, managed service providers and any vendor whose product carries Acronis technology inside it. The order borrows the statutory meaning of “covered article” [1], and the FAR clause’s version of that definition includes software and services “that include embedded or incidental information technology” [4]. If your appliance, MSP stack or SaaS backup tier runs on an Acronis engine, I’d treat it as covered until someone in government says otherwise. The order doesn’t define “indirectly,” and I could be wrong about how far DHS means it to go.

Contractor-operated systems are in scope. The FASC’s own rule says a removal order can reach “an information system operated by a contractor on behalf of an agency” [3]. That’s the FISMA footnote again [1]. If you host or manage systems for a civilian agency, its removal deadline is yours too.

The FAR mechanics are the same as for DeepSeek. Clause 52.204-30 bars contractors from providing or using, in contract performance, products from a source named in an applicable order [4]. During performance you check SAM.gov for “FASCSA order” at least every three months, run a reasonable inquiry when a new order could touch your supply chain, report within 3 business days and follow up on mitigation within 10 [4]. The clause flows down to all subcontracts, “including subcontracts for the acquisition of commercial products and commercial services” [4]. A new order applies to an existing contract only once it’s added by modification, but the quarterly check and the reporting duty don’t wait [4].

Budget for it yourself. Mayer Brown pointed out after the 2025 order that FAR 52.204-30 doesn’t contemplate an equitable adjustment when a post-award order adds cost or time; its advice was to raise it under the Changes clause [6]. A five-person MSP migrating an agency’s backup retention to a new platform eats that cost unless it negotiates.

Removing backup software is a migration. The 180 days is the honest part of this order. A backup agent sits on every endpoint and server, and the archives it wrote may only restore through its own tools. Pulling the agent is easy. Proving you can still restore last year’s data without it is the work, and that’s what I’d start on now.

One drafting point. The Federal Register preamble describes the excluded products as those “developed by Acronis, Inc., Acronis SCS, and affiliated entities,” while the signed order names Acronis AG and its affiliates [1]. The affiliate test probably sweeps all of them in. Still, three corporate names across two pages of the same notice is the sort of thing a reseller’s lawyer will ask about.

What I’m watching

• January 27, 2027. Nextgov/FCW’s removal deadline for civilian agencies [5]. Watch whether DHS publishes anything about exceptions it granted; the order says only that DHS will approve or disapprove in writing [1].
• A challenge. Under 41 U.S.C. 1327, a named source can seek judicial review within 60 days after being notified of an order [3]. The public record doesn’t say when Acronis was notified of this one.
• Annual review. The order says the Secretary will review it within one year and every year after [1]. With EQT’s ownership change and CFIUS clearance already on the record [5], that review is where any change in the company’s position would show up.