CISA Directive Targets Risks From Unsupported Edge Devices
CISA Directive Targets Risks From Unsupported Edge Devices
https://www.executivegov.com/articles/cisa-directive-edge-device-security
Publish Date: 2026-02-06 16:53:00
Source Domain: www.executivegov.com
The Cybersecurity and Infrastructure Security Agency has introduced a new directive requiring federal civilian executive branch, or FCEB, agencies to strengthen security controls for edge devices by removing unsupported hardware and software from federal networks.
CISA’s new directive highlights the continued focus on strengthening cybersecurity across government networks. As agencies and industry stakeholders track evolving requirements and threat-driven priorities, the Potomac Officers Club’s 2026 Cyber Summit will bring together leaders from across the federal cyber community. Register now to save your seat at this May 21 event!
CISA said Thursday the directive—Binding Operational Directive 26-02, Mitigating Risk From End-of-Support Edge Devices—is intended to reduce technical debt and limit the risk of cyber compromise associated with devices that no longer receive vendor security updates.
What Are the Required Actions Under the CISA Edge Device Security Directive?
CISA outlined several mandatory steps agencies must take under the directive, including updating vendor-supported edge devices running end-of-support software to a vendor-supported version and conducting an inventory of all devices to identify those that are end-of-support. Agencies must also report inventory findings to CISA.
The directive also requires agencies to remove all end-of-support edge devices from agency networks and replace them as needed with vendor-supported devices that can receive security updates. Agencies must develop a mature lifecycle management process for continuous discovery of edge devices and maintain an inventory of those that are or will become end-of-support.
What Did CISA Leadership Say About Edge Device Security?
CISA Acting Director Madhu Gottumukkala said unsupported edge devices should not remain on enterprise networks due to the risk they pose to federal systems.
“When the threat landscape demands decisive action, CISA will direct FCEB agencies to strengthen…
