The text of the End-of-Support Edge Device Inventory and Decommission Plan
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every quarter until 2028-02-05, then every year.
Mandate. The Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-02, Mitigating Risk From End-of-Support Edge Devices, on February 5, 2026. It requires agencies to act on this schedule:
- At once: upgrade vendor-supported edge devices that still run end-of-support software.
- Within 3 months (May 5, 2026): inventory the devices on the CISA End-of-Support Edge Device List.
- Within 12 months (February 5, 2027): decommission the listed devices, and inventory every edge device that is end-of-support or will be within 12 months.
- Within 18 months (August 5, 2027): decommission the remaining identified devices.
- From 24 months (February 5, 2028): discover edge devices continuously, and decommission each one on or before its end-of-support date.
The plan also meets National Institute of Standards and Technology (NIST) SP 800-53 controls SA-22, CM-8, and MA-1 for the Organization’s edge devices.
1. Purpose and Scope #
Vendors no longer release security fixes for an end-of-support edge device, and attackers target boundary devices first. The CISO uses this plan to find these devices in the Organization, remove them, and keep them from coming back. The plan covers every routing, firewall, virtual private network, load-balancing, remote-access, and similar boundary device, physical or virtual. It covers devices on networks that the Organization owns or operates, including devices that contractors run for it.
2. Requirements and Deadlines #
| BOD 26-02 requirement | Date | Status |
|---|---|---|
| Upgrade vendor-supported devices running end-of-support software | At once (2026-02-05) | [complete / open] |
| Inventory devices on the CISA End-of-Support Edge Device List and submit CISA’s template | 2026-05-05 | [complete / open] |
| Decommission listed devices; inventory devices that are end-of-support or will be within 12 months | 2027-02-05 | Open |
| Decommission remaining identified end-of-support edge devices, and report | 2027-08-05 | Open |
| Discover continuously; decommission on or before each device’s end-of-support date | From 2028-02-05 | Open |
3. Discovery and Inventory #
The network lead keeps the edge device inventory in the Continuous Diagnostics and Mitigation (CDM) hardware inventory. For each device, the inventory shows the vendor, model, software version, support status, end-of-support date, and owner. The network lead runs discovery on the BOD 23-01 schedule, every 7 days. Each time CISA updates its End-of-Support Edge Device List, the network lead reconciles the inventory against it. When the network lead cannot establish a device’s support status, the network lead treats the device as end-of-support until the vendor confirms otherwise.
The discovery and lifecycle tools are:
(No technology inventory entries for this family.)
4. Decommission Schedule #
| Device or class | End-of-support date | Replacement or mitigation | Target date | Owner |
|---|---|---|---|---|
| [from inventory] | [date] | [replace / migrate / isolate] | [on or before the BOD deadline] | [network lead / System Owner] |
An Emergency Directive (ED) can set an earlier date for some devices. ED 25-03 required agencies to disconnect certain end-of-support firewall devices permanently by September 30, 2025. ED 26-01 requires agencies to disconnect and decommission public-facing application delivery devices from one vendor that have reached end of support. The network lead checks each active ED against the inventory, and the earliest date applies.
The network lead decommissions each device through the change management process. Each change includes a security impact analysis and a verified replacement in service. The network lead confirms that the retired device’s configuration, credentials, and certificates are withdrawn. When a listed device cannot be removed by its deadline, the Chief Information Officer (CIO) accepts the risk in writing after the network lead applies isolating controls. The CISO reports the exception to CISA as the directive’s template requires.
5. Lifecycle Management #
From February 5, 2028, no edge device may operate past its end-of-support date. To keep that true:
- The network lead records each device’s end-of-support date when it is bought.
- The acquisition policy requires vendors to state how long they will support each device.
- System Owners plan refresh budgets against the end-of-support dates in the inventory.
- Each quarter, the CISO reviews the end-of-support dates for the next 18 months.
6. Roles and Responsibilities #
| Role | Responsibility |
|---|---|
| CIO | Approves the plan. Accepts the remaining risk for any device kept past its deadline. Reports to CISA. |
| CISO | Owns the plan. Reconciles the inventory with the CISA list. Tracks the deadlines. |
| Network lead | Keeps the edge device inventory and carries out replacements. |
| System Owners and Information System Security Officers (ISSOs) | Make sure the edge devices serving their systems are in the inventory and replaced on schedule. |
| Contracting Officers and Contracting Officer’s Representatives | Write support-period disclosure and replacement obligations into contracts. |
7. References #
These are the sources this document cites, with a link to each official text.
- CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
- CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
- CISA ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, September 25, 2025.
- CISA ED 26-01: Mitigate Vulnerabilities in F5 Devices, October 15, 2025.