The Acronis Order Gives 180 Days and Never Says From When
A company that operates a backup, recovery or file-sharing system for a civilian agency should plan to have every Acronis component out of it by January 27, 2027, including one licensed inside another vendor's product. The Department of Homeland Security's FASCSA order against Acronis requires civilian agencies to remove Acronis covered articles from their information systems "within 180 calendar days of the issuance of the Order," and it says in its own text that those systems include ones a contractor operates for an agency. The order never says which date is issuance. January 27, 2027 is 180 days counted from the original release date printed on the order, July 31, 2026, the earliest of the dates it could mean. The DeepSeek order DHS published on October 20, 2026 gave no window at all; its removal ran "immediately after the issuance of the Order."
What the order requires
DHS published notice of Exclusion and Removal Order #2026-02 at 91 FR 68528 on October 30, 2026. The signed order applies to federal civilian executive branch agencies, except for their national security systems and secure compartmented information systems. It directs them to exclude Acronis AG, its affiliated entities and the covered articles they supply from agency procurement actions, and to remove those articles from agency information systems. Footnote 4 says which systems count.
The words are the statute's, and the order prints them as its own scope. A company running an agency's backup or file shares cannot read itself out of the removal on the ground that the servers are its own. DHS's summary of risk says that Acronis's "cyber and backup tools have privileged or root access to customer security systems."
180 days from an undated issuance
The order runs two clocks for agencies. Exclusion from ongoing and future procurements takes effect "immediately after issuance of this Order." Removal runs for 180 calendar days from issuance, and the order never dates issuance. The record carries three candidates.
- July 31, 2026, the original release date printed on the order.
- October 27, 2026, when SAM.gov's DHS FASCSA order record for Acronis AG went active.
- October 30, 2026, when the Federal Register printed the order.
Counted 180 calendar days from each, the removal window ends January 27, 2027, April 25, 2027 or April 28, 2027. Three months separate the earliest reading from the latest.
An agency that cannot finish in time may ask DHS in writing, within 60 days of issuance, for an exception from some or all of the order, including one "for a period of time before compliance with the order is practicable." DHS approves or disapproves each request in writing. Counted from the July 31 release date, those 60 days ran out on September 29, 2026, a month before the Federal Register printed the order. An operator that needs more time depends on its agency having asked DHS for it, possibly before the order was ever printed.
Until removal is complete, the order encourages agencies to monitor traffic, keep logs, control data exfiltration and flag anomalous activity. On a system a contractor operates, those controls sit with the operator.
Supplied directly or indirectly
The order reaches covered articles that Acronis AG or an affiliate supplied "directly or indirectly," and it takes "covered article" from 41 U.S.C. § 4713(k)(2), which includes hardware, devices, software and services with embedded or incidental information technology. An Acronis engine licensed into another vendor's backup appliance or managed recovery service is an Acronis covered article supplied indirectly, whatever brand the appliance carries.
The affiliate test is control. Footnote 2 makes a business an affiliate of Acronis AG if, "directly or indirectly, either one controls or can control the other; or a third party controls or can control both." The notice names "Acronis, Inc., Acronis SCS, and affiliated entities." SAM.gov's DHS record names Acronis AG alone, and Acronis SCS Inc of Tempe, Arizona appears there only under a Department of Defense order. A name search will not settle whether a US entity sits inside the DHS order; the control test does.
The clause side
SAM.gov has carried a DHS FASCSA order record for Acronis AG since October 27, 2026. The earlier Acronis records came from the Department of Defense, active March 10, 2026, and the Office of the Director of National Intelligence, active July 11, 2025. FAR 52.204-30 applies DHS orders to contracts outside Defense, so on a civilian contract that carries the clause the reasonable inquiry and the 3-business-day report to the contracting officer apply to Acronis whether or not the contract has been modified to add the order. The DeepSeek piece sets out how those duties run.
Where it lands
Unless DHS has approved an exception for the agency it serves, an operator has no later date it can point to. A replacement scheduled for April 2027 rests on a reading of issuance the order never gives. If the release date is the one that counts, a system still carrying Acronis in February 2027 is the operator's system, holding up an order its agency was required to have met.