DHS Mandates Federal Purge of Acronis Software Over Historical Russian FOCI Risks

Scrutiny of Acronis spanned nearly a decade across multiple presidential administrations. Federal officials focused heavily on the company’s historical reliance on Moscow-based research and development talent, legacy codebases adapted for Russian state contracts, and systemic supply chain vulnerabilities. Although investigators cited no concrete evidence of backdoors connecting Acronis systems to Moscow, FASC determined that structural risks outweighed corporate mitigation efforts. Acronis had previously attempted to de-risk its operational footprint following Russia’s 2022 invasion of Ukraine by shuttering Russian operations, relocating engineering talent, and undergoing a majority buyout by Swedish private equity firm EQT.

For defense contractors and IT integrators, the mandate extends far beyond direct prime procurement. Acronis tools—widely deployed for data backup, disaster recovery, and endpoint security—were predominantly integrated into federal environments via third-party channel partners and resellers. Defense industrial base companies and federal contractors servicing government networks must immediately audit their enterprise IT stacks and managed service offerings to ensure Acronis components are fully decoupled from agency-facing environments ahead of the compliance deadline.

This action signals a critical precedent for government contracting and defense acquisition strategy: post-hoc corporate restructuring may no longer be sufficient to clear deep-seated legacy code origin risks. Federal acquisition authorities are increasingly willing to exercise administrative exclusion mechanisms to purge software platforms with historic foreign exposure, even in the absence of active compromise. Defense leaders and industry prime contractors should prepare for accelerated FASC reviews targeting non-U.S. software vendors in federal supply chains. (Source: Washington Technology)