CISA Mandates Removal of Unsupported Edge Devices to Protect Federal Networks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical mandate requiring Federal Civilian Executive Branch (FCEB) agencies to remove unsupported edge devices from their networks within the next 12 to 18 months. This directive, known as Binding Operational Directive 26-02, aims to reduce the attack surface that state-sponsored threat actors increasingly exploit to gain unauthorized access to federal systems.

The Growing Threat Landscape

CISA's directive comes in response to a concerning trend where persistent cyber threat actors are increasingly targeting unsupported edge devices as preferred access pathways into federal networks. These devices, positioned at the network perimeter, present an especially vulnerable entry point for both new and known vulnerabilities.

"Persistent cyber threat actors are increasingly exploiting unsupported edge devices -- hardware and software that no longer receive vendor updates to firmware or other security patches," CISA stated in its announcement. "Positioned at the network perimeter, these devices are especially vulnerable to persistent cyber threat actors exploiting a new or known vulnerability."

What Constitutes an Edge Device?

Edge devices encompass a broad range of networking components that route network traffic and hold privileged access. This includes:

• Load balancers
• Firewalls
• Routers
• Switches
• Wireless access points
• Network security appliances
• Internet of Things (IoT) edge devices
• Software-defined networks
• Other physical or virtual networking components

CISA's Comprehensive Action Plan

The directive establishes a phased approach with specific timelines for FCEB agencies to follow:

Immediate Actions (Effective Immediately)

• Update each vendor-supported edge device running end-of-support software to a vendor-supported software version

Short-term Requirements (Within 3 Months)

• Catalog all devices to identify those that are end-of-support
• Report findings to CISA

Medium-term Requirements (Within 12 Months)

• Decommission all edge devices that are end-of-support and listed in CISA's edge device list from agency networks
• Replace them with vendor-supported devices that can receive security updates

Long-term Requirements (Within 18 Months)

• Decommission all other identified edge devices from agency networks
• Replace with vendor-supported devices that can receive security updates

Ongoing Process (Within 24 Months)

• Establish a lifecycle management process to enable continuous discovery of all edge devices
• Maintain an inventory of those that are/will reach end-of-support

CISA's Support Infrastructure

To assist agencies in compliance, CISA has developed an end-of-support edge device list that serves as a preliminary repository. This list contains:

• Product names
• Version numbers
• End-of-support dates

This resource helps agencies identify which devices require immediate attention and replacement.

The Rationale Behind the Directive

The directive addresses the accumulation of technical debt within federal networks. Unsupported devices that no longer receive security updates from original equipment manufacturers (OEMs) create significant vulnerabilities that threat actors actively exploit.

CISA Acting Director Madhu Gottumukkala emphasized the importance of this initiative: "Unsupported devices pose a serious risk to federal systems and should never remain on enterprise networks. By proactively managing asset lifecycles and removing end-of-support technology, we can collectively strengthen resilience and protect the global digital ecosystem."

Broader Implications for Cybersecurity

This directive represents a significant shift in how federal agencies approach network security. Rather than attempting to patch or mitigate risks from unsupported devices, CISA is mandating complete removal and replacement with supported alternatives.

The 12 to 18-month timeline provides agencies with sufficient time to plan and execute these changes while maintaining operational continuity. However, it also creates urgency for agencies to begin inventorying their edge devices immediately.

Compliance and Enforcement

As a Binding Operational Directive, this mandate carries the full weight of federal authority. FCEB agencies must comply with these requirements or face potential consequences. The directive's phased approach allows for systematic implementation while ensuring that the most critical vulnerabilities are addressed first.

Agencies are required to report their progress to CISA at various milestones, enabling federal oversight and ensuring accountability throughout the implementation process.

Looking Forward

This directive sets a precedent for how federal agencies should approach legacy technology and cybersecurity. By establishing clear timelines and providing supporting resources, CISA is creating a framework that other organizations might follow to enhance their own security postures.

The focus on edge devices recognizes that perimeter security remains a critical component of overall network defense, especially as threat actors continue to target these entry points for initial access to larger networks.

For more information about CISA's Binding Operational Directive 26-02 and the end-of-support edge device list, visit CISA's official website. Agencies can also access technical guidance and implementation resources through the CISA Cybersecurity Division.