CISA BOD 26-02: 12 Months to Rip Out End of Life Devices
What Is CISA's Binding Operational Directive 26-02?
The Cybersecurity and Infrastructure Security Agency has issued Binding Operational Directive 26-02 (BOD 26-02), establishing a 12-month operational window for federal civilian agencies to identify and remove unsupported edge devices from their networks (CISA, 2026).
Why? Because nation-state actors have developed persistent exploitation patterns targeting CISA end-of-support edge devices across federal infrastructure. The operational intelligence is unambiguous.
CISA BOD 26-02 represents a data-driven response to a pattern of federal legacy network devices cybersecurity exposure that sophisticated adversaries have systematically catalogued and weaponized.
Why CISA Orders to Replace Unsupported Edge Devices
Persistent Exploitation Campaigns
The operational reality demands integrated visibility.
According to CISA Executive Assistant Director for Cybersecurity, adversaries with nation-state capabilities have established persistent targeting methodologies against the unsupported edge devices security risk embedded within federal network architectures. The pattern analysis reveals coordinated, resourced operations.
We've seen this pattern repeatedly. These aren't opportunistic actors. These are adversaries with operational continuity, technical infrastructure, and strategic patience.
What Makes End-of-Life Edge Devices So Dangerous?
Unremediable vulnerabilities. Manufacturers have terminated support lifecycles for these systems. Zero-day discoveries compound into permanent exposure. Vulnerabilities cannot be patched, they can only be catalogued by adversaries and integrated into exploitation frameworks.
Network topology positioning. Edge devices occupy critical perimeter positions within the enterprise ontology. They interface with internal networks, identity management systems, and sensitive data flows. Compromise at the edge establishes lateral movement capability across the entire operational environment.
Federal technical debt. Budgetary constraints across multiple fiscal cycles have created infrastructure persistence beyond rational operational lifecycles. Adversaries maintain comprehensive databases of deployed systems, vendor distributions, and version-level detail across federal agency networks.
Incomplete asset ontology. Defense requires complete data integration. Most agencies lack comprehensive edge device inventory visibility, creating asymmetric information advantages for adversaries who maintain superior intelligence on the actual deployed infrastructure.
Nation-State Actors Are Already Here
CISA references "persistent cyber campaigns" and "recent public reports of campaigns targeting certain vendors" (CISA, 2025). The language indicates classified intelligence supporting the directive.
Chinese and Russian advanced persistent threat groups have executed multiple campaigns specifically targeting end-of-support firewall replacement scenarios and legacy edge infrastructure from vendors including Barracuda, Ivanti, Fortinet, Cisco, and Juniper Networks (Mandiant, 2024).
These operations exhibit characteristics CISA describes as "substantial and constant, resulting in a significant threat to federal property." They demonstrate operational sophistication, persistence, and demonstrated effectiveness.
What indicators would convince you that an unsupported edge device is already being used as a pivot point into internal identity or management networks?
BOD 26-02 Requirements:
BOD 26-02 Summary: What Federal Agencies Must Do
Your BOD 26-02 compliance checklist establishes three operational timelines:
Within 3 Months:
Provide CISA with complete inventory of all devices matching the CISA EOS Edge Device List
Identify all end-of-life network device inventory across your enterprise
Document current federal edge device lifecycle management processes (or lack thereof)
Within 12 Months:
Decommission all identified end-of-support devices
Execute your end-of-life device replacement plan
Complete emergency replacement unsupported firewall installations for critical infrastructure
Within 24 Months:
Establish continuous discovery processes for edge devices approaching end-of-life
Implement automated federal edge device modernization workflows
Deploy monitoring that actually tells you what's running on your network
How to Comply with CISA BOD 26-02?
Complete visibility precedes operational compliance.
Step 1: Establish Comprehensive Asset Intelligence
To identify end-of-life devices on network infrastructure requires acknowledging incomplete data integration. You cannot satisfy BOD 26-02 requirements without comprehensive infrastructure visibility.
Traditional asset management assumes known device ontologies. But edge infrastructure accumulates across operational timeframes, organizational changes, contractor deployments, and decentralized technology decisions. The platform requirements include:
Agentless device detection across distributed network architectures
Cross-referenced manufacturer end-of-support dates against deployed infrastructure
Differentiation between EOL vs EOS edge devices (End-of-Life vs End-of-Support, both represent operational risk)
Dependency mapping to prevent service disruption during replacement operations
Step 2: Prioritize Based on Integrated Risk Intelligence
Not all end-of-support devices present equivalent threat vectors. Operational triage requires:
Internet-facing exposure - Devices with public internet accessibility undergo continuous adversarial reconnaissance.
Active exploitation indicators - Monitoring systems detecting reconnaissance patterns or anomalous traffic targeting specific edge devices reveal active adversary interest.
Critical system integration - Assets interfacing with identity management, classified networks, or sensitive data flows.
Compensating controls - Network segmentation, behavioral monitoring, or detection capabilities providing temporal risk mitigation.
Step 3: Maintain Operational Intelligence During Replacement
Government rip and replace legacy devices programs operate across extended timelines. During procurement and implementation cycles, you require monitoring infrastructure that reveals whether end-of-life devices are experiencing active exploitation, what lateral movement patterns emerge from compromised edge infrastructure, and whether network segmentation effectively contains threat actor movement.
Budget Integration:
Emergency procurement for devices showing active exploitation
Multi-year modernization budgets for systematic replacement
Monitoring infrastructure that doesn't blind you during the transition
Technical Architecture:
Alignment with zero trust edge device requirements
Migration to cloud-managed devices where it makes sense
Automated patch management for everything you deploy
Behavioral monitoring that works regardless of device age
Operational Continuity:
Phased replacement schedules with continuous threat detection
Parallel operation during transitions with visibility into both old and new infrastructure
Actual testing before you decommission the old stuff
Step 4: Integrated Threat Detection
The BOD 26-02 implementation guide emphasizes ongoing lifecycle management, but you also need continuous threat detection. Automated alerts when devices approach end-of-support dates. Real-time monitoring for exploitation attempts. Behavioral analysis that detects anomalous activity. Integration between lifecycle management and threat detection, when a device falls out of support, monitoring should automatically increase.
What Devices Does BOD 26-02 Cover?
CISA End-of-Support Edge Devices Categories
The directive applies to hardware and software "no longer supported by its original equipment manufacturer," (CISA, 2025) specifically:
Network Infrastructure:
Routers and switches
Firewalls and network security appliances
Load balancers
Wireless access points
VPN concentrators
Edge Computing:
Internet of Things (IoT) edge devices
Remote access gateways
Branch office security appliances
Unified threat management systems
CISA maintains the EOS Edge Device List as a controlled dataset (operational security considerations prevent public distribution), but agencies receive access to this continuously updated inventory.
EOL vs EOS Edge Devices: What's the Difference?
End-of-Life (EOL): Manufacturer discontinued the product entirely. No support available under any circumstances.
End-of-Support (EOS): Manufacturer still sells the product but stopped providing
security updates for older versions.
Both fall under CISA BOD 26-02 requirements because from a security perspective, unsupported is unsupported.
End-of-Life Software Security Risks
While edge hardware gets the attention, the directive also covers end-of-life software security risks and unsupported software cybersecurity risk. Many edge devices run embedded operating systems that reach end-of-support independently of the hardware lifecycle.
Using unsupported operating systems risks include:
Unpatched zero-days that will never be fixed
Incompatibility with modern security tools
End-of-life systems compliance requirements violations
Inability to integrate with SIEM, threat intelligence, or monitoring platforms
When conducting your BOD 26-02 compliance assessment, you need to evaluate both hardware AND end-of-support software cybersecurity status. That firewall might be physically fine, but if it's running firmware the vendor stopped supporting in 2019, it's still a problem.
Frequently Asked Questions
How often does CISA update the EOS Edge Device List?
Expect quarterly updates as manufacturers announce end-of-support dates and new threat intel emerges about exploited devices.
Does BOD 26-02 apply to cloud-managed edge devices?
Yes. If the underlying device firmware or management software reaches end-of-support, it's covered.
Can agencies request deadline extensions?
The directive allows agencies to work with CISA on implementation challenges, but the core timelines are mandatory. Start your identify end-of-support edge devices process and engage CISA early if you hit roadblocks.
How is this different from normal vulnerability management?
Standard vulnerability management assumes vulnerabilities can be patched. CISA orders federal agencies to replace unsupported edge devices because these systems cannot be patched. The only remediation is replacement or decommissioning.
What Does It Mean?
Visibility establishes the operational foundation. You cannot inventory assets outside your data integration framework. Traditional CMDBs and scheduled scans fail to capture the edge devices adversaries actively exploit. Threat monitoring is not optional.
Adversaries maintain active targeting. Nation-state actors from China and Russia have established persistent campaigns against unsupported edge devices security risk across federal infrastructure. They operate on their timeline, not yours.
EOL and EOS represent identical risk profiles. End-of-Life and End-of-Support devices present the same operational vulnerability. Both fall under CISA BOD 26-02 requirements. Both require continuous monitoring until replacement.
Software lifecycle independence. Don't overlook end-of-life software security risks. Embedded operating systems and firmware reach end-of-support through independent lifecycle trajectories from hardware.
Prioritize through threat intelligence, not chronological age. Identify which devices adversaries are actively targeting, then prioritize those for emergency replacement.
This requires institutional process, not project execution. Federal edge device lifecycle management demands continuous discovery, automated alerts, and integrated threat detection. Build sustainable operational processes or face cyclical crisis response.
Three non-negotiable timelines: 3 months to establish complete inventory. 12 months to decommission identified systems. 24 months to implement continuous processes.
Firmware EOS blindsides hardware-focused audits every time. Reach out if embedded OS gaps blew up your initial sweep, we'll cross-reference against agency-wide surprise rates and unpatched software risks hitting compliance.
You'll dodge emergency replacement chaos, we'll refine lifecycle management blindspots. Integrated intelligence reveals what siloed analysis misses.
References
Cybersecurity and Infrastructure Security Agency (CISA). (2025). Binding Operational Directive 26-02: Remove Unsupported Edge Devices. Retrieved from https://www.cisa.gov/directives
Mandiant. (2024). APT Trends Report: Edge Device Exploitation Campaigns. Retrieved from https://www.mandiant.com
