What is CISA BOD 26-02?

The guidance in CISA BOD 26-02 on end-of-support (EoS) and end-of-life (EoL) software, particularly for internet-exposed and operational edge devices, reflects this reality. The guidance reinforces what many agencies already know: unsupported edge software is both a technical issue and a mission readiness risk. 

CISA’s BOD 26-02 Five Step Timeline 

CISA’s BOD 26-02 sets a compliance clock providing agencies with a timeline to complete a series of concrete steps by certain dates: 

• Feb 5, 2026: Apply safe vendor-supported updates.
• May 5, 2026: Inventory and report on edge devices that appear on CISA’s EOS list.
• Feb 5, 2027: Decommission devices that have reached EOS.
• Aug. 5, 2027: Replace remaining EOS edge devices with vendor-supported equipment.
• Feb. 5, 2028: Operationalize continuous discovery and EOS tracking of edge devices. 

The Risk of Unsupported Edge Software Is a Decision Problem 

Edge devices like firewalls, VPN appliances, load balancers, and other network-connected infrastructure often sit outside traditional endpoint and server management workflows. When these devices reach the end of support, they stop receiving security updates, even as new vulnerabilities continue to emerge. 

CISA has consistently emphasized the risks associated with unsupported software. Once a product is no longer supported by the vendor, organizations lose access to security patches, technical support, and validated mitigation guidance. In many cases, newly disclosed vulnerabilities cannot be remediated at all. This leaves agencies exposed at the network edge. 

For most public sector teams, the challenge lies on the decision-making side with operational and budget constraints: 

• Where do unsupported assets exist today?
• Which unsupported systems are externally exposed or operate at the network edge?
• Which ones meaningfully impact mission operations?
• Which risks require immediate action, and which require planning, funding, or compensating controls? 

Without shared, trusted context, these decisions are slow, fragmented, and difficult to justify. 

Staying Ahead of Guidance Rather Than Chasing It 

The focus of CISA BOD 26-02 on end-of-support edge devices reflects the reality of today’s threat landscape. Attackers are targeting outdated infrastructure. Because of this, agencies are expected to both identify these risks and demonstrate how decisions are being made to manage them.