DHS’s new order banning Acronis AG from federal systems also sheds new light on security concerns U.S. officials have about the company’s products and services.
The Department of Homeland Security has banned Swiss cybersecurity firm Acronis AG from civilian agency networks, following a ban on the company’s products from intelligence community systems last year.
DHS’s ban, laid out in an “exclusion and removal order” scheduled to be published in the Federal Register on Oct. 30, also sheds new light on security concerns U.S. officials have about Acronis’ products.
While the order signed by Homeland Security Secretary Markwayne Mullin is being publicly released this week, it’s dated July 31. The Acronis order follows a similar exclusion and removal order released by DHS last week banning Chinese artificial intelligence firm DeepSeek from federal networks.
The latest order directs agencies to exclude Acronis AG and its affiliated entities, as well as any products directly or indirectly supplied by them, from all ongoing and future procurement actions. It also directs them to remove Acronis products from agency information systems within 180 calendar days.
DHS’s ban comes after the director of national intelligence banned Acronis from intelligence community procurements and information systems last year. That order came at the recommendation of the Federal Acquisition Security Council and was the first removal and exclusion order issued under the Federal Acquisition Supply Chain Security Act.
The General Services Administration last year also followed suit and removed Acronis products and services from its multiple award schedules.
In a “summary of risks,” DHS’s order states that “Acronis’s cyber and backup tools have privileged or root access to customer security systems and present significant risk to the U.S. government information systems.”
The document doesn’t elaborate further. But in IT, “root access” refers to an administrative privilege that grants virtually unlimited access to all programs, files, and resources on a system.
Last year’s intelligence community directive gave no such detail on the underlying security concerns about Acronis products.
“The DHS published an exclusion order that was expected as part of the original FASCSA order issued on May 19, 2025,” an Acronis spokesperson told Federal News Network. “The DHS exclusion order only applies to U.S. federal agencies and was originally signed and published on July 31, 2026. This does not affect our customers and partners. We continue to work with the U.S. government agencies to address any concerns that they may have.”
Acronis AG was founded in 2003 in Singapore and is headquartered in Switzerland. The company has U.S. subsidiaries that provide data protection, data backup, secure file sharing, and disaster recovery solutions.
The extent to which Acronis has been used within federal systems and contracts in recent years is unclear. Acronis hasn’t been awarded a federal contract since fiscal 2016, according to USASpending.gov, but its products and services are offered through a network of resellers and partners, making it difficult to track to what extent it could have been used by federal agencies, contractors and subcontractors.
Meanwhile, Acronis announced earlier this month that Gerald Caron, a former chief information security officer at the International Trade Administration, had been appointed as the company’s new chief information security officer.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
