Federal directive on end-of-support edge devices. Issued 2026-02-05.
Binding Operational Directive 26-02, "Mitigating Risk From End-of-Support Edge Devices," was issued by the Cybersecurity and Infrastructure Security Agency on . It applies to U.S. Federal Civilian Executive Branch (FCEB) agencies and requires them to manage the lifecycle of edge devices to defend against malicious cyber activity, per CISA's directive page.
The directive's stated rationale: nation-state threat actors exploit end-of-support edge devices, "including, but not limited to, load balancers, firewalls, routers, and virtual private network (VPN) gateways," to gain network access, maintain presence, and compromise sensitive data. The companion CISA, FBI, and NCSC fact sheet is published at Reducing the Attack Surface for End-of-Support Edge Devices.
Although BOD 26-02 binds only FCEB agencies, CISA, FBI, and NCSC explicitly encourage all organizations to follow the same guidance. State, local, tribal, and territorial governments, critical infrastructure operators, and private-sector organizations whose contracts or insurance carriers reference federal cybersecurity baselines should expect this directive to be cited in audit, underwriting, and procurement reviews.
Scope: edge devices
"Edge devices include technology that resides on the boundary of an organization's network and is accessible from the public internet and other external environments. An edge device becomes an 'end-of-support' or 'unsupported' device when its manufacturer no longer:
- Monitors it for defects in its software and/or firmware, and
- Updates it with patches for common vulnerabilities and exposures (CVEs), security updates, and software fixes (hotfixes)."
The fact sheet enumerates load balancers, firewalls, routers, and VPN gateways as non-exhaustive examples. CISA maintains a separate, authoritative EOS Edge Device List that the directive references for scoping the inventory and decommissioning obligations. That list is the operational source of truth for which specific devices an FCEB agency must report and replace, not this page and not any third-party writeup.
Compliance deadlines
BOD 26-02 establishes a staggered timeline measured from the issuance date of . Dates below are calendar projections of those windows.
Immediate: Update vendor-supported edge devices running end-of-support software (including firmware) to vendor-supported versions, where the update does not adversely affect mission-critical functionality.
(3 months): Inventory all edge devices on CISA's EOS Edge Device List and report that inventory to CISA using the CISA-provided template.
(12 months): Decommission identified EOS edge devices whose end-of-support date falls on or before this window, replacing as needed with vendor-supported devices that can receive security updates.
(18 months): Decommission all remaining identified EOS edge devices from agency networks.
(24 months): Establish a continuous discovery process for all edge devices and maintain a rolling inventory of those that are EOS or will become EOS within twelve months.
Devices in our catalog from commonly-named vendors
The directive itself does not enumerate vendor names; it scopes obligations to devices on CISA's EOS Edge Device List. Analyst writeups and CISA's own historical KEV postings most commonly highlight Cisco, Fortinet, Palo Alto Networks, Ivanti, Juniper, and F5 as the vendor footprint where FCEB agencies will see the most overlap. Below is a filtered view of our lifecycle catalog scoped to those six vendors and to products currently at end-of-sale or end-of-life. Verify against the vendor's own bulletin and CISA's EOS Edge Device List before acting.
Showing up to 50 newest entries per vendor. See full inventories: Cisco, Fortinet, Paloalto, Ivanti, Juniper, F5. Vendors absent from this site (currently Fortinet, Ivanti) will populate as collectors land.
What this means operationally
If you operate FCEB infrastructure, the inventory submission on is the immediate gate; the 12, 18, and 24-month decommissioning waves follow. If you do not, BOD 26-02 still functions as a procurement and audit signal: see our compliance and insurance impact page for how PCI-DSS 6.3.3, HIPAA 164.308, NIST SP 800-53 SA-22, and cyber-insurance underwriters treat unsupported components, and our lifecycle terminology reference for what each vendor's milestone names mean. For vendors with substantive published policy docs see the per-vendor lifecycle policy hubs: Cisco, Juniper, Palo Alto.