Understanding CISA BOD 26-02: Mitigating Risk from End-of-Support Edge Devices

CISA issued Binding Operational Directive (BOD) 26-02 on February 5, 2026, requiring Federal Civilian Executive Branch agencies to address security risks from End-of-Support (EOS) edge devices like firewalls, routers, and VPN gateways. The directive sets a two-year compliance timeline: agencies must inventory EOS devices by May 2026, begin replacements by February 2027, complete removals by August 2027, and establish continuous lifecycle management by February 2028. Cisco promotes its FedRAMP-authorized Security Cloud for Government portfolio—including Security Cloud Control, Secure Access for Government, Meraki, Duo Federal, and SD-WAN—as cloud-native solutions that reduce hardware dependency and help agencies meet BOD 26-02 compliance deadlines.