CISA Orders Removal of Unsupported Edge Devices

CISA Orders Removal of Unsupported Edge Devices to Reduce Federal Network Risk

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive to federal agencies, requiring them to inventory, upgrade, and remove unsupported edge devices within 12 to 18 months, with the goal of reducing the risk of cyber-espionage. This move is expected to impact over 100,000 devices across federal networks, as state-sponsored threat actors increasingly target these devices as a preferred access pathway.

Why This Matters

The presence of unsupported edge devices on federal networks poses a significant risk to national security, as these devices can be easily exploited by threat actors to gain access to sensitive information. The cost of such breaches can be substantial, with the average cost of a data breach in the federal sector exceeding $1 million per incident. Furthermore, the use of unsupported devices can lead to technical debt, making it more difficult for agencies to maintain and update their networks, and increasing the likelihood of future breaches.

Key Insights

• CISA has developed an end-of-support edge device list to help agencies identify devices that are no longer supported by their manufacturers: https://www.cisa.gov/
• The use of unsupported edge devices can lead to significant security risks, including the exploitation of known vulnerabilities: “Persistent cyber threat actors are increasingly exploiting unsupported edge devices” (CISA, 2026)
• Agencies can use lifecycle management processes to identify and remove unsupported devices, reducing the risk of cyber-espionage: “Establish a lifecycle management process to enable continuous discovery of all edge devices” (CISA, 2026)

Working Example

# Example of a lifecycle management process for edge devices
1. Identify all edge devices on the network
2. Check the manufacturer's website for end-of-support information
3. Update or replace devices that are no longer supported
4. Continuously monitor the network for new devices and update the inventory

Practical Applications

• Use Case: The Department of Defense can use CISA’s end-of-support edge device list to identify and remove unsupported devices from their networks, reducing the risk of cyber-espionage.
• Pitfall: Failing to establish a lifecycle management process can lead to the presence of unsupported devices on the network, increasing the risk of security breaches.

References:

• https://www.cisa.gov/
• http://thehackernews.com/2026/02/cisa-orders-removal-of-unsupported-edge.html
• https://www.cisa.gov/publication/mitigating-risk-end-support-edge-devices