Removed: end-of-support edge devices on CISA’s list — decommissioned where support ends within a year, and off agency networks within eighteen months for the rest.
Outcome: not yet public. CISA’s progress report is due fifteen months after issuance.
CISA turned the same subtraction into a requirement. Binding Operational Directive 26-02, issued on 5 February 2026, tells federal civilian agencies to inventory the end-of-support devices on its list, decommission those whose support ends within a year, and have the rest off agency networks within eighteen months.
The directive gives its reason for starting at the perimeter: “Edge devices are attractive targets due to their extensive reach into an organization’s network and integrations with identity management systems.” A firewall or router the vendor stopped patching is a standing path from the internet into the network, and monitoring it does not close the path.
Whether agencies meet those dates is not yet public — CISA’s progress report is due fifteen months after issuance — and the release announcing it asks non-federal organisations to do the same.
Sources: