US Orders Federal Agencies to Purge Acronis Software After Years of Scrutiny Over Russian Ties

Federal civilian agencies in the United States must remove all Acronis software from their networks by January 27, under an order from the Department of Homeland Security that was only made public in late October. The directive, signed on July 31 by Homeland Security Secretary Markwayne Mullin, gives agencies 180 days to complete the removal. It extends a ban that already covered intelligence and defense systems to the wider civilian government.

The order matters because backup and security tools are not ordinary office software. They typically run with deep access to the systems they protect, which is why officials treat supply chain questions about them as a national security issue rather than a purchasing preference. For agencies that still run Acronis products, the next few months will mean finding replacements, moving backup routines, and proving the old software is gone.

What the order requires

According to reports on the directive, agencies must eliminate Acronis products within 180 days of the July 31 order, which puts the deadline at January 27. The order covers Acronis AG and its affiliates, including the US companies Acronis Inc. and Acronis SCS. It warns that the company's cyber and backup tools have privileged or root access to customer security systems and pose a significant risk to government networks.

That wording points to the core concern. A backup tool needs broad permission to copy files, read system data, and restore machines after a failure. If that tool were compromised or influenced from outside, the damage could reach far beyond a single workstation. The order does not allege a specific breach of a federal system, and the reporting so far does not describe one. The case rests on access and influence risk, not on a disclosed incident.

Why Acronis drew scrutiny for years

Acronis was founded in Singapore in 2003 and is now headquartered in Schaffhausen, Switzerland. It sells data protection, backup, secure file sharing, and recovery software. Various defense and civilian services have used its products, including the Defense Information Systems Agency, the Drug Enforcement Administration, and the National Oceanic and Atmospheric Administration. Nextgov reported that Acronis was last awarded a federal contract in 2016.

Reporting by Nextgov, based on two sources familiar with the matter, says federal oversight spanned multiple administrations and focused largely on development ties in Russia. Officials examined the firm under Foreign Ownership, Control or Influence guidelines, known as FOCI, starting in the first Trump administration. Key questions included whether Russian developers remained involved in Acronis codebases and whether the company had adequately reduced related supply chain risks, according to a former DHS official. Both former officials spoke on condition of anonymity.

A chain of earlier bans

The civilian order did not arrive out of nowhere. It followed a sequence of earlier restrictions that gradually closed off parts of the federal market. The director of national intelligence issued the first order ever under the Federal Acquisition Supply Chain Security Act against Acronis, barring its products from intelligence community systems. That order took effect in July 2025 but did not become public until September, when the General Services Administration also pulled Acronis products from its GSA Advantage online marketplace.

The Department of Defense has since issued its own Acronis order, according to a Congressional Research Service note cited in reporting last week. With intelligence, defense, and now civilian systems covered, the federal market for the company has effectively narrowed to a close. Each step used a different authority and a different part of the government, which is one reason the process took so long. A supply chain exclusion is a serious step, and officials appear to have built the case in stages rather than acting on a single review.

What the order does not do

The DHS order targets federal civilian systems. It does not prohibit Acronis from operating in the American private sector, and it does not ban private companies or home users from buying or using its products. That distinction matters for readers who use Acronis software at home or at work outside government. The order is about government networks, where the risk calculation includes sensitive systems, foreign influence rules, and the deep access that backup tools require.

It also does not, on the reporting available so far, claim that Acronis software was used to steal federal data. Readers should be careful not to read more into the order than it says. A removal order based on risk, access, and unresolved supply chain questions is not the same as a finding that a breach occurred. The public record describes scrutiny, anonymous sourcing about that scrutiny, and a formal risk decision, not a disclosed intrusion.

What agencies face next

Agencies now have a fixed clock. They must inventory where Acronis software runs, including older machines that may have been forgotten in a server room or a field office. Backup tools often sit quietly for months, running scheduled jobs in the background, so a complete inventory is harder than it sounds. Agencies will also need replacement tools, tested restores to prove the new setup works, and documentation that the old software is fully removed, not just switched off.

Frequently Asked Questions

What exactly must federal agencies do under the Acronis order?

Federal civilian agencies must remove all Acronis software from their networks within 180 days of the July 31 order, which sets the deadline at January 27. The order covers Acronis AG and its affiliates, including Acronis Inc. and Acronis SCS, and it cites the privileged or root access that backup and security tools hold.

Why did the review of Acronis take years?

Reporting says oversight spanned multiple administrations and focused on development ties in Russia, examined under Foreign Ownership, Control or Influence guidelines. Officials looked at whether Russian developers remained involved in Acronis codebases and whether supply chain risks had been adequately reduced.

Does the order ban Acronis for private users?

No. The order applies to federal civilian systems and does not prohibit the company from operating in the American private sector. Private users are not covered by the directive, though the case is a useful prompt to check what access any backup tool holds and to keep it updated.