DHS Extends Acronis Exclusion to Civilian Agency Procurements

The U.S. Department of Homeland Security (DHS) signed a Federal Acquisition Supply Chain Security Act (FASCSA) exclusion and removal order on July 31, 2026, covering products and services from Acronis AG, Acronis, Inc., and Acronis SCS. The order applies in federal civilian agency procurements and to covered information systems, including systems that contractors operate on an agency’s behalf. DHS’s public notice appeared on October 30, after the 60-day period in which agencies could request exceptions had elapsed. The timing matters for contractors: the public notice came after that agency exception-request window, making it important to promptly establish whether affected technology is present in relevant supply chains and environments.

The action expands the Acronis-related restrictions beyond the Intelligence Community context addressed by a separate Office of the Director of National Intelligence (ODNI) order in September 2025. That earlier order covered Acronis in Intelligence Community procurements and specified systems. Contractors should not assume that one order replaces or fully defines the other. Businesses supporting both civilian agencies and the Intelligence Community need to assess the scope and applicability of each order independently, including which products, services, procurements, and systems are covered.

For federal contractors, the order creates a supply-chain and contract-compliance review issue that can extend beyond direct purchases. Acronis products or services may enter an environment through resellers, subcontractors, managed-service arrangements, or contractor-operated systems. Companies should map direct and indirect sources, identify where the technology is deployed, and determine whether affected deployments relate to covered agency systems or procurement activity. The source also advises affected companies to follow applicable contract reporting clauses; contractors should review their specific contract terms and established notification processes rather than assume that a single reporting approach applies across all awards.

The notice identifies the General Services Administration (GSA) among the agencies and offices associated with the issue, but the supplied information does not provide a specific GSA procurement action, contract, or implementation instruction. It also does not state the order’s detailed technical scope, list particular contract vehicles, or identify a contractor-specific exception. Those details should not be inferred from the notice alone. GovCon teams can use the announcement as a trigger to coordinate procurement, cybersecurity, legal, and supply-chain functions; document findings; and seek authoritative guidance where contract applicability is unclear. This is especially relevant for companies that rely on commercial IT products across multiple federal accounts, where the same platform may appear in different contractual or operational contexts.

• DHS signed the FASCSA order on July 31, 2026, covering Acronis products and services in civilian agency procurements and covered information systems.
• The scope includes systems contractors operate on an agency’s behalf, not only systems directly owned or purchased by an agency.
• DHS’s public notice appeared October 30, after the agencies’ 60-day exception-request period had elapsed.
• Review direct and reseller-supplied inventories for products and services associated with Acronis AG, Acronis, Inc., and Acronis SCS.
• Map identified technology to contracts, subcontracts, managed services, and agency-related systems to determine whether the order may apply.
• Affected companies should follow applicable contract reporting clauses and their established contract-notification procedures.
• A separate September 2025 ODNI order covers Acronis in Intelligence Community procurements and specified systems; assess that order separately.
• Contractors serving both civilian agencies and the Intelligence Community should document scope and compliance reviews across each applicable account.
• The supplied notice does not specify individual contracts, detailed technical boundaries, or contractor-specific exceptions; verify unclear requirements through authoritative channels.