DHS Orders Acronis Out of Federal Systems

The Department of Homeland Security has ordered federal agencies to stop buying Acronis products and remove them from agency information systems within 180 calendar days. The order, signed by Homeland Security Secretary Markwayne Mullin and dated July 31, applies to Acronis AG, its affiliated entities and products they directly or indirectly supply. The exclusion and removal order is scheduled for publication in the Federal Register on Oct. 30.

The directive reaches into the government’s purchasing and technology systems: agencies must exclude the company from ongoing and future procurement actions, then remove its products from their information systems. The order governs federal agencies, not all Acronis customers. The company’s spokesperson told Federal News Network, “This does not affect our customers and partners.”

The security case, in the government’s words

DHS cited the access built into Acronis’s cyber and backup tools as the central concern. In its “summary of risks,” the department said: “Acronis's cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems.” The document does not elaborate further.

In IT, “root access” means an administrative privilege that grants virtually unlimited access to programs, files and resources on a system. The agency’s order therefore rests on a stated risk tied to that level of access, while the public explanation offers no additional detail about the specific concerns. The order adds detail about U.S. officials’ security concerns and follows a similar DHS order released the previous week banning Chinese artificial intelligence firm DeepSeek from federal networks.

A ban with a longer paper trail

The DHS action follows an earlier exclusion of Acronis products from intelligence community systems. The director of national intelligence barred Acronis from intelligence community procurements and information systems on the recommendation of the Federal Acquisition Security Council. That was the first removal and exclusion order issued under the Federal Acquisition Supply Chain Security Act. The intelligence community directive did not detail the underlying security concerns.

The General Services Administration also removed Acronis products and services from its multiple award schedules. Acronis said the DHS order was expected as part of the original FASCSA order issued on May 19, 2025. Its spokesperson said the DHS exclusion order “only applies to U.S. federal agencies” and was “originally signed and published on July 31, 2026.” The spokesperson added, “We continue to work with the U.S. government agencies to address any concerns that they may have.”

What the order reaches—and what’s unclear

The extent of Acronis’s use within federal systems and contracts in recent years is unclear. According to USASpending.gov, the company has not received a federal contract since fiscal 2016. But its products and services are available through resellers and partners, making their use by federal agencies, contractors and subcontractors difficult to track. The government has drawn a formal boundary around procurement and system use; the available figures don’t show how widely those products have circulated through other channels.

Acronis AG was founded in 2003 in Singapore and is headquartered in Switzerland. Its U.S. subsidiaries provide data protection, data backup, secure file sharing and disaster recovery solutions. Earlier this month, Acronis announced that Gerald Caron, a former chief information security officer at the International Trade Administration, had been appointed the company’s new chief information security officer. In the order, federal agencies—not the company’s broader customer base—are the ones directed to remove the products and bar future purchases.