DHS Orders Acronis Out of Civilian Agencies (11/05/2026)

Backup and security agents sit in an unusual place in any network. They run with root or administrator rights on almost every machine, they can read nearly everything, and they are trusted by default because their job is protection. That is the reason DHS gave for ordering Acronis products out of civilian federal systems, and it applies to every product in that category, whoever makes it.

Top 5 Critical Compliance Alerts

1. DHS Excludes Acronis Products From Civilian Agencies

A DHS exclusion and removal order under the Federal Acquisition Supply Chain Security Act bars Acronis products from ongoing and future civilian agency procurements and requires their removal from covered information systems, including those contractors operate for agencies, within 180 days of issuance, per JD Supra. DHS cited the privileged or root access that Acronis cybersecurity and backup tools have to customer systems. The order is dated July 31 but was published October 30, after a similar Intelligence Community order in September 2025, and GSA has pulled Acronis products from GSA Advantage. Contractors must make a reasonable inquiry into their supply chains and report covered products within the deadlines their contract clauses set, as short as 72 hours.

Operator Note: Federal contractors should search their environments for Acronis agents now, including copies bought through resellers or bundled by a managed service provider. Everybody else can borrow the reasoning: list every tool running with root or administrator rights across your estate, and ask who could reach it.

2. DOJ Opens a Healthcare Self-Disclosure Pilot

A DOJ pilot running through April 22, 2027 lets healthcare companies self-disclose potential civil False Claims Act violations and resolve them for 1.25 to 1.6 times a base repayment amount, with a coordinated release from DOJ and HHS and no corporate integrity agreement, per Corporate Compliance Insights. It covers only conduct the government does not already know about, and submissions must be complete, with documents and a quantified repayment. Relators filed 458 healthcare qui tam suits in fiscal 2025, and because those are filed under seal, a company may already be too late without knowing it.

Operator Note: The pilot rewards organizations that can investigate their own problems quickly. If your internal investigation process takes months to reach a number, that is the thing to fix before you ever need this.

3. Pennsylvania Requires Disclosure of AI-Generated Advertising

Pennsylvania’s Artificial Intelligence Deceptive Advertising Act, signed October 22 and effective December 21, requires advertisers using AI-generated or significantly modified content that creates a false impression about the nature, origin, or authenticity of goods or services to disclose it clearly and conspicuously, per JD Supra. The attorney general or a district attorney can seek fines of up to $3,000 per violation, and there is no private right of action.

4. DEA Sets a November 29 Deadline for Medical Cannabis Supply Chains

On October 30 the DEA issued its first registrations to state-licensed medical cannabis dispensaries and set a November 29 deadline for every medical cannabis business to confirm it buys from and sells to only DEA registrants, per JD Supra.

5. The SEC Publishes Its 2027 Examination Priorities

The SEC’s Division of Examinations announced its fiscal 2027 priorities on October 23, continuing its focus on investment advisers’ fiduciary obligations among other areas, per JD Supra. The list is consistent with the Division’s 2026 priorities, so firms that prepared for last year’s exams should find the focus areas familiar.

Additional Compliance Alerts

Regulatory Updates

• The EU adds a record 1,646 names to its Russia sanctions list: The October 12 designations reach suppliers to Russia’s military-industrial supply chains, raising screening work for government contractors. JD Supra

Healthcare

• Vida Y Salud-Health Systems and Hampton Regional Medical Center settle breach lawsuits: Both class actions over data breaches have been resolved. HIPAA Journal

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.