February 24, 2026

The U.S. is a favorite target for threat actors. Often, those threat actors  take advantage of unsupported devices residing on the edge of an organization’s network perimeter. Firewalls, VPNs, routers, IoT devices, and even personal devices like smart watches  and cameras are all potential entry points, especially when they’ve reached the end of support (EOS). To mitigate these issues, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive (CISA BOD 26-02) requires federal agencies to inventory all devices on the CISA EOS Edge Device List and report that inventory to CISA within 90 days of issuance, with longer-term requirements for decommissioning and lifecycle governance.

The Straight Talk on BOD 26-02

Binding Operational Directive 26-02 (BOD 26-02) is CISA drawing a hard line on EOS edge devices. Without regular patching or vendor support, existing vulnerabilities persist. Attackers know that those devices, when exposed externally, provide a perfect entry point and pivot point for lateral movement into federal networks.

BOD 26-02 sets deadlines for inventory, decommissioning, and ultimately, continuous discovery, so EOS devices don’t creep back in after the initial sweep is finished. 

An Edge Device Management Mindset Shift

BOD 26-02 intends to minimize organizational risk and to shift how federal agencies approach edge device management. The shift?

Stop treating refresh like a “big bang”

Most agencies fail at edge device lifecycle management because the refresh gets delayed until the process becomes untenable and overwhelming. Those delays can stem from limited staffing, low tolerances for outages, or simply not maintaining the asset inventory. Regardless, budget is always a factor. By the time approved devices make it through procurement and into production, they’re already closer to end-of-life than anyone expected.

The Winning Strategy for BOD 25-02 Alignment: Incremental Modernization

They always say the best way to eat an elephant is one bite at a time. Modernizing an IT environment is similar. 

Few organizations can afford to do a wholesale replacement at once. The best strategy is to break the whole into manageable projects.  By working incrementally, you can decrease risk, minimize outages, and enable more predictable funding.

It also helps the process if your organization can standardize edge stacks. Fewer design types and versions lead to less chaotic environments and easier update paths.

Finally, design your IT architecture for replacement. Again, less is more. Focus on modular architectures and clean change windows that enable repeatable cutovers.

Practical Ways to Beat EOS Without Blowing up Budgets

BOD 26-02 is lighting a fire under federal agencies. As of its issuance in February 2026, it requires agencies to immediately update any devices that do not pose an impact on mission critical functionality. Within 3 months – May 2026 – agencies must inventory and report all edge devices listed on the CISA’s EOS list using the CISA-provided template.

Here are a few practical steps that you can take to manage edge devices across federal networks and build a lifecycle modernization strategy. 

1. Build an “EOS runway”

BOD 26-02 ultimately requires continuous discovery + inventory of EOS/soon-to-be-EOS edge devices. If you treat modernization like an operational discipline, not a compliance drill, you’ll have the tools to continuously track every edge device with:

• Model/version
• EOS date
• Management plane exposure
• Internet exposure
• Mission criticality

2. Use a 3-lane approach

It’s not always practical to update everything all at once. Instead, use a staggered approach. 

• Lane A – Upgrade now: Apply vendor-supported updates to edge devices, provided such an update won’t harm mission critical functionality. 
• Lane B – Replace next: Focus on devices that have already hit EOS or will be hitting their EOS date within the next 12 months. 
• Lane C – Redesign over time: Focus on devices where the architecture is brittle: load balancer pairs, VPN, legacy DMZ patterns. This focus will enable you to build the right strategy to minimize risk and downtime.

3. Make procurement match the clock

The timeline for BOD 26-02 calls for significant progress at both 12 months and 18 months. At those milestones, agencies must decommission and report, first for listed devices, then for all EOS edge devices. Specifically:

• Within 12 months (February 2027) 
  • Decommission devices that have reached EOS.
  • Report decommissions to CISA using the CISA-provided template
  • Inventory all edge devices within their environments that are EOS or will become EOS within 12 months that are within the scope of this directive. 
• Within 18 months (August 2027)
  • Decommission and replace remaining EOS edge devices with vendor-supported equipment that can receive current security updates.
  • Report decommissions to CISA using the CISA-provided template
• Within 24 months (February 2028):
  • Define a process for continuous discovery of all edge devices and maintain an inventory of those that are or will become EOS within their environments.
  • Having decommissioned devices on or before EOS dates, report decommissions to CISA using the CISA-provided template. 

That means acquisition plans should lock early with:

• Approved vendor configurations
• Standard baselines
•  “No-EOS” contract language for managed services

4. Turn edge refresh into a zero trust enabler

Every device needs a verified identity. With your new, comprehensive inventory, now is the time to revisit zero trust concepts like multi-factor authentication (MFA), asset identity, workload isolation, and encryption in transit. 

In fact, refreshing edge devices is your chance to modernize:

• Identity-backed admin access
• Segmented management networks
• Stronger access policy,
• Encrypted control planes
• Better telemetry

The Bottom Line on BOD 26-02

With BOD 26-02, CISA is telling agencies: unsupported edge devices are an unacceptable risk, and this one is easily remedied with disciplined lifecycle management and steady refresh. The fastest way to win is to stop waiting for a massive tech refresh. Instead make refresh a repeatable, budgetable, annual operating rhythm.

Are you ready to get started with incremental modernization of your edge devices? GuidePoint Security can help. We work with government agencies of all sizes and at all levels of federal, state, and local government, providing tailored solutions and services so you can complete your mission with better cybersecurity decisions that minimize risk.

Learn more >