The US government is removing Acronis from its systems. What should everyone else do?

The US Department of Homeland Security has told federal civilian agencies to stop buying Acronis and take it off their systems. If you run Acronis for your own organisation or for customers, someone is going to ask you about it. Here is what the order actually says, what it doesn't say, and a calm way to respond.

What happened

Federal News Network reported on 28 October that DHS has issued an "exclusion and removal order" against Acronis AG. The order was signed by Homeland Security Secretary Markwayne Mullin on 31 July and was due to be published in the Federal Register on 30 October.

It does two things. Federal civilian agencies must exclude Acronis, its affiliates and any products it supplies, directly or indirectly, from current and future purchasing. And they must remove Acronis products from their information systems within 180 calendar days, or ask for an exception.

This isn't the first step. Last year the US Director of National Intelligence issued a similar order covering the intelligence community, the first one made under the Federal Acquisition Supply Chain Security Act. The General Services Administration also took Acronis off its multiple award schedules.

What it says about the risk

Very little. The order's summary of risks says that "Acronis's cyber and backup tools have privileged or root access to customer security systems" and that this poses a significant risk to US government systems. Neither this order nor last year's intelligence community order explains the underlying concern in public. ExecutiveGov notes the order gives no further technical detail.

It's worth being precise about that sentence. Privileged access is true of almost every backup and endpoint security product. To back up a server or stop ransomware, the agent has to run with high privileges. So the statement describes why a supplier of this kind of tool matters, not a specific flaw that has been found.

What Acronis says

Acronis told Federal News Network that the order "was expected as part of the original FASCSA order issued on May 19, 2025", that it "only applies to U.S. federal agencies", and that "this does not affect our customers and partners". It says it continues to work with US agencies on their concerns.

What this is, and what it isn't

This is a US government purchasing and supply chain decision. It is not:

a vulnerability advisory or CVE,
a report of a breach at Acronis,
a CISA emergency directive, or
a UK government instruction. I couldn't find any NCSC guidance on it at the time of writing.

So there's no patch to apply and nothing to switch off today. But "no action today" isn't the same as "ignore it". When a government removes a backup tool from its own networks and won't say why, it's reasonable for your customers to want an answer.

How I'd handle it

1. Know who might care

Most UK small businesses won't be affected at all. The ones to think about are those that work with the US federal government, sell into it through a supply chain, or have contracts or insurance policies that refer to approved supplier lists. Check whether any customer falls into those groups. If they do, they may need to raise it with their own customers or legal team.

2. Write a short, honest answer now

Don't wait for the question. A few lines is enough: what the order says, that it applies to US federal civilian agencies, that no technical flaw has been published, and what you're doing about it. Avoid both "nothing to see here" and anything that sounds like panic. Stick to the sources.

3. Tighten the things that matter anyway

The concern DHS names is privileged access. That's true of every backup platform, so this is a good moment to check the basics, whichever product you use:

MFA on every account that can sign in to the backup console, with no shared logins.
As few admin accounts as possible, and none that are also used for email.
Immutable or offline copies, so a compromised console can't delete everything.
Alerts when a backup plan is changed, a job is deleted or retention is shortened.
A restore test you've actually done recently, not one that's assumed to work.

4. Don't make a big decision on a headline

Changing backup platform is a large piece of work, and a rushed migration is a real risk in its own right: gaps in coverage, missed retention and restores nobody has tested. If a customer is required to move, plan it properly, run both side by side for a while and keep the old backups until their retention has passed. If they aren't required to move, write down why you're staying, keep watching for any technical detail that's published, and review again if it changes.

The bigger picture

Backup and security agents sit in the most trusted spot on every machine. That's why attackers go after them, and it's why governments look hard at who supplies them. Whatever you think of this order, the lesson is the same as it was last week: treat the backup console as one of the most sensitive systems you run, and make sure that even with admin rights, nobody can quietly delete your way back.

Sources

← All posts