CISA BOD 26-02

Federal directive on end-of-support edge devices. Issued 2026-02-05.

Scope: edge devices

"Edge devices include technology that resides on the boundary of an organization's network and is accessible from the public internet and other external environments. An edge device becomes an 'end-of-support' or 'unsupported' device when its manufacturer no longer:

- Monitors it for defects in its software and/or firmware, and

- Updates it with patches for common vulnerabilities and exposures (CVEs), security updates, and software fixes (hotfixes)."

CISA, FBI, NCSC: Reducing the Attack Surface for End-of-Support Edge Devices (2026-02-05).

The fact sheet enumerates load balancers, firewalls, routers, and VPN gateways as non-exhaustive examples. CISA maintains a separate, authoritative EOS Edge Device List that the directive references for scoping the inventory and decommissioning obligations. That list is the operational source of truth for which specific devices an FCEB agency must report and replace, not this page and not any third-party writeup.

Compliance deadlines

BOD 26-02 establishes a staggered timeline measured from the issuance date of 2026-02-05. Dates below are calendar projections of those windows.

• Immediate: Update vendor-supported edge devices running end-of-support software (including firmware) to vendor-supported versions, where the update does not adversely affect mission-critical functionality.
• 2026-05-05 (3 months): Inventory all edge devices on CISA's EOS Edge Device List and report that inventory to CISA using the CISA-provided template.
• 2027-02-05 (12 months): Decommission identified EOS edge devices whose end-of-support date falls on or before this window, replacing as needed with vendor-supported devices that can receive security updates.
• 2027-08-05 (18 months): Decommission all remaining identified EOS edge devices from agency networks.
• 2028-02-05 (24 months): Establish a continuous discovery process for all edge devices and maintain a rolling inventory of those that are EOS or will become EOS within twelve months.

Source: CISA BOD 26-02 directive page.

Devices in our catalog from commonly-named vendors

The directive itself does not enumerate vendor names; it scopes obligations to devices on CISA's EOS Edge Device List. Analyst writeups and CISA's own historical KEV postings most commonly highlight Cisco, Fortinet, Palo Alto Networks, Ivanti, Juniper, and F5 as the vendor footprint where FCEB agencies will see the most overlap. Below is a filtered view of our lifecycle catalog scoped to those six vendors and to products currently at end-of-sale or end-of-life. Verify against the vendor's own bulletin and CISA's EOS Edge Device List before acting.

Showing up to 50 newest entries per vendor. See full inventories: Cisco, Fortinet, Paloalto, Ivanti, Juniper, F5. Vendors absent from this site (currently Fortinet, Ivanti) will populate as collectors land.

What this means operationally

If you operate FCEB infrastructure, the inventory submission on 2026-05-05 is the immediate gate; the 12, 18, and 24-month decommissioning waves follow. If you do not, BOD 26-02 still functions as a procurement and audit signal: see our compliance and insurance impact page for how PCI-DSS 6.3.3, HIPAA 164.308, NIST SP 800-53 SA-22, and cyber-insurance underwriters treat unsupported components, and our lifecycle terminology reference for what each vendor's milestone names mean. For vendors with substantive published policy docs see the per-vendor lifecycle policy hubs: Cisco, Juniper, Palo Alto.

Sources

• CISA Binding Operational Directive 26-02: Mitigating Risk From End-of-Support Edge Devices (primary)
• CISA, FBI, NCSC joint fact sheet: Reducing the Attack Surface for End-of-Support Edge Devices (primary)
• BleepingComputer: CISA orders federal agencies to replace end-of-life edge devices (supporting context, not primary)

Last reviewed 2026-04-27.