CISA Mandates Phase-Out of Unsupported Edge Devices in Federal Networks

The U.S. Cybersecurity and Infrastructure Security Agency issued a binding operational directive Thursday requiring federal civilian agencies to identify and replace outdated edge devices on their networks within the next 18 months, aiming to curb a growing cyber threat from unsupported hardware and software.

Binding Operational Directive 2602, titled Mitigating Risk From End-of-Support Edge Devices, applies to Federal Civilian Executive Branch agencies. It mandates immediate updates to any vendor-supported edge devices running outdated software, provided such changes do not disrupt essential operations. Within three months, agencies must inventory all edge devices using a list provided by the agency and report end-of-support devices. Over the following 12 months, they must begin removing unsupported ones, with full elimination required by the 18-month mark. Agencies will also need to establish ongoing processes within two years to track device lifecycles and prevent unsupported technology from reappearing on networks.

Edge devices include firewalls, routers, switches, load balancers, wireless access points, Internet of Things components, software-defined networking elements,...