CISA Binding Operational Directive 26-02, issued 5 February 2026, applies to federal civilian executive branch agencies, not to vendors directly. It tells agencies to inventory and remove end-of-support edge devices. Vendors of edge products may feel it indirectly, through agency questions about support dates and contract changes.
Definitions
Binding Operational Directive is a compulsory direction CISA issues to federal civilian agencies. Edge device here means equipment at the agency network boundary, such as firewalls, routers, load balancers and wireless access points. End of support (EOS) means the vendor no longer provides updates.
What it requires of agencies
| Deadline | Requirement |
|---|---|
| Immediately | Update vendor-supported edge devices running end-of-support software to a supported version, unless that would harm mission-critical functions |
| 3 months | Inventory devices on CISA's EOS edge device list and submit it to CISA |
| 12 months | Decommission listed devices whose EOS dates have passed; inventory devices that are EOS or will be within 12 months |
| 18 months | Decommission all identified EOS edge devices |
| 24 months | Establish continuous discovery of edge devices and decommission by EOS date |
Per the directive, it does not cover operational technology devices, national security systems or certain defense and intelligence systems, and it excludes some FedRAMP authorized cloud products that OMB M-24-15 defines as out of scope. It applies to agencies, though agencies may need to change contracts to comply.
What it means for a supplier
If you make edge products, expect questions like these from agency customers and primes:
- What is the end-of-support date for each model and software version?
- How far ahead will you announce it?
- Are updates available for the whole supported period?
- Can you list your devices in a machine-readable inventory format?
CISA's Product Security Bad Practices also list not clearly communicating the support period for on-premises products. See the bad practices self-check.
What to do now
- Publish support and end-of-life dates on a page customers can find.
- Notify customers in writing before a model reaches end of support.
- Tie each date to a security update commitment, not just a sales commitment.
- Keep older software versions visible in your own inventory so you know who still runs them.
What it does not tell you
The directive does not create a certification, and it does not say how contracts must be worded. Read your own contract. For why edge devices draw attention, see edge devices as initial access.
Quick check
Does BOD 26-02 apply to a private company?
Not directly. It binds federal civilian agencies. A company may be affected through its agency customers.
Does it cover OT devices?
No. The directive excludes operational technology devices.
Safeguard provides asset discovery and SBOM and dependency scanning, which help a team know what runs where. It does not manage network edge hardware. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
