The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has established mandatory deadlines for federal civilian agencies to remove unsupported network edge devices from their operating environments. Binding Operational Directive 26-02, issued February 5, 2026, requires agencies to identify affected equipment and decommission devices that can no longer receive appropriate vendor security support. The first major removal deadline arrives in February 2027, followed by a broader decommissioning requirement in August 2027.
For IT asset disposition (ITAD) providers and electronics recyclers, the directive establishes a timetable for potential network hardware retirement. Removing equipment from a government network does not automatically make it available for commercial resale or recycling. Federal property management requirements determine how assets move through reuse and disposal channels, while cybersecurity considerations can limit whether unsupported devices remain suitable for a secondary market.
The commercial opportunity depends on two separate processes. Agencies must comply with CISA’s cybersecurity deadlines, while retired equipment must subsequently be handled through authorized property disposition procedures. Companies providing secure decommissioning services could participate before hardware reaches the recycling stage, depending on agency procurement arrangements.
Key Findings & Outlook
- Federal agencies face two major retirement deadlines. CISA requires specified unsupported devices on its initial list to be decommissioned by February 2027, with broader removal of identified end-of-support edge devices required by August 2027.
- The affected equipment includes several major ITAD categories. CISA’s definition covers firewalls, routers, switches and wireless access points, along with load balancers, network security appliances and Internet of Things (IoT) edge devices.
- The initial CISA device list is not public. Agencies receive a preliminary list of affected equipment, but the list is not publicly available. This prevents outside recovery companies from establishing the number or precise mix of devices targeted by the first deadline.
- Cybersecurity retirement does not authorize commercial disposal. Federal property rules establish separate procedures for equipment reuse and disposal. ITAD providers must identify the organization with legal authority to release the equipment.
- Secure decommissioning presents a potential service opportunity. Equipment identification, removal and documented handling may require specialized assistance. CISA does not specify how much of this work agencies will outsource.
CISA establishes a phased retirement timetable
CISA’s directive addresses network edge devices located at the boundaries of federal information systems. These devices can be exposed to external network threats, creating security concerns when manufacturers no longer provide updates or technical support.
The agency defines edge devices broadly. Its examples include load balancers, firewalls, routers, switches, wireless access points, network security appliances and IoT edge devices. The definition also encompasses software-defined networking equipment and other physical or virtual devices responsible for routing traffic or providing privileged access.
This scope is relevant to equipment recovery companies. Switches and wireless access points are established categories of network hardware handled through enterprise ITAD programs, while firewalls and security appliances can require additional attention to retained configurations and access credentials.
The directive applies to Federal Civilian Executive Branch agencies and covered information systems operated on their behalf. It does not impose the same requirements on every state government, local agency or private enterprise.
CISA expressly excludes operational technology devices and certain cloud products and services identified as outside its scope. The directive also does not apply to statutorily defined national security systems or specified systems operated by defense and intelligence organizations.
The required actions extend over two years, beginning with the February 5 issuance date. Agencies were instructed to update unsupported software on otherwise supported edge devices immediately where doing so would not adversely affect mission-critical functions.
Within three months, agencies were required to identify devices on CISA’s initial end-of-support list and report their inventories. By February 5, 2027, agencies must decommission specified devices on the initial list and update the broader inventory. The August 5, 2027 deadline extends the requirement to identified unsupported edge devices covered by the directive. By February 5, 2028, agencies must maintain processes for continuous discovery and timely decommissioning of affected equipment.
These deadlines establish an agency-wide cybersecurity compliance schedule. They do not specify how many devices will ultimately be removed or which equipment manufacturers account for the largest volumes.
The nonpublic device list limits recovery forecasts
CISA developed an initial End-of-Support Edge Device List to help federal agencies identify affected products. The list provides product names, version information and vendor support dates.
The list is distributed to agencies and is not publicly available. CISA’s directive describes its role in the initial identification process, while subsequent inventory requirements place responsibility on agencies to identify unsupported devices throughout their environments.
For ITAD providers, this creates a limitation in assessing the market. The public directive identifies equipment categories and compliance deadlines, but it does not provide the number of affected devices.
The distinction also affects downstream electronics recyclers. A deadline applying to federal agencies cannot be converted into a forecast of recoverable circuit boards or other materials without knowing the actual equipment population.
Commercial estimates will require agency-level inventories or confirmed equipment replacement projects. Procurement records and contracts may provide additional evidence as agencies organize their compliance work.
Federal modernization spending provides context
The Government Accountability Office (GAO) has repeatedly identified aging technology as a federal management challenge. In July 2025, GAO reported that the government spends more than 100 billion dollars annually on information technology and related cybersecurity investments, with roughly 80% historically directed toward operating and maintaining existing systems. Its review of critical legacy systems identified unsupported hardware or software and known cybersecurity vulnerabilities among persistent problems.
A further GAO report, issued in July 2026, examined the Technology Modernization Fund. As of June 2025, approximately 1.03 billion dollars had been invested in 68 projects. According to the report, 11 projects had recorded combined savings of 13.5 million dollars, while 24 anticipated approximately 1.06 billion dollars in savings. These figures provide context for federal modernization spending. They do not isolate expenditures associated with replacing network edge devices or establish the value of equipment available for recovery.
Modernization programs can also involve different types of technology changes. Some projects replace physical hardware, while others concentrate on software or the migration of workloads. For recovery companies, the financial scale of a modernization program therefore cannot be translated directly into potential ITAD revenue. Equipment inventories and confirmed replacement contracts offer a stronger basis for estimating commercial activity.
Secure decommissioning involves more than physical removal
An unsupported firewall or router can create information-security concerns even after it has been disconnected from an agency network. Network devices may retain configuration information or authentication material associated with the environments in which they operated. Their disposition must address relevant information-security obligations as well as the physical equipment.
CISA’s directive focuses on removing unsupported devices from service and maintaining appropriate lifecycle controls. It does not prescribe one commercial sanitization procedure covering every device model.
Agencies and their contractors must establish the appropriate handling requirements based on the equipment and the applicable security policies. This creates a potential role for ITAD providers with network hardware expertise. Contractors could be asked to support serialized inventories and controlled equipment transfers, with documented sanitization where required. The work can become more demanding when devices are distributed across federal offices and remote network facilities.
There is also a difference between secure retirement and equipment destruction. A device can complete its authorized service within an agency while remaining physically functional. Its suitability for another use depends on security support and applicable property requirements. The absence of vendor security updates can sharply restrict legitimate reuse options, particularly for equipment intended to operate at network boundaries.
Federal property rules determine equipment disposition
The General Services Administration (GSA) establishes policies for managing and disposing of federal personal property. Federal agencies generally must evaluate applicable reuse and transfer opportunities before disposing of surplus equipment. Depending on the property’s status and the governing authority, assets can be reassigned within an agency or transferred elsewhere in the federal government.
Eligible property can also move through authorized donation or sale programs. The Federal Acquisition Regulation provides related requirements for government property held by contractors. The current FAR Part 45 addresses contractor management of government property and the reporting and disposal of contractor inventory.
FAR 45.602-2, Reutilization Priorities, establishes the order in which plant clearance officers initiate reutilization actions for covered property.
The provision identifies reuse within the owning agency as the first priority. It also provides for transfers of educationally useful equipment to schools and nonprofit organizations, followed by reporting eligible property to GSA for further federal reuse or donation.
These provisions apply to government property within the scope of FAR Part 45. They should not be interpreted as one universal procedure covering every asset owned directly by a federal agency.
The distinction is important for ITAD providers developing federal accounts. A cybersecurity directive can require equipment to be decommissioned without transferring ownership of the hardware to the contractor performing the work.
An organization responsible for equipment removal may be required to safeguard the assets and transfer them through an authorized process. A separate property official or organization can retain authority over the final disposition.
GSA’s Federal Management Regulation Bulletin B-34, Disposal of Federal Electronic Assets, provides additional guidance on environmentally responsible handling of federal electronics.
The bulletin encourages reuse of functional equipment through authorized federal property channels and directs attention to certified refurbishers and recyclers when assets are disposed of through applicable procedures.
GSA’s electronic-waste guidance similarly advises federal organizations to consider reuse or refurbishment before recycling. It identifies R2- and e-Stewards-certified recyclers as options for managing equipment at the end of its useful life.
For downstream processors, actual material availability begins after applicable property decisions have been made. Removing a device from a government network does not automatically make it available to an independent recycler.
Procurement opportunities depend on agency responsibilities
Federal network replacement work may be performed by government employees or under existing technology support contracts.
Agencies could also obtain replacement equipment through broader modernization agreements. CISA’s directive does not establish a single procurement model for completing the required work.
Commercial opportunities may therefore arise at different stages of the equipment lifecycle.
A network integration contractor could perform installation and decommissioning under an existing agreement, while a separate ITAD provider handles equipment after it is released from service.
Another contract could combine network replacement and equipment disposition within one scope of work.
For ITAD companies, identifying the organization responsible for property disposal is as important as identifying the agency replacing its equipment.
Federal technology contractors may already have relationships with the affected agencies, while authorized property management organizations control subsequent decisions concerning retired assets.
Partnerships with incumbent contractors could provide access to specialized decommissioning work where an independent ITAD provider lacks a direct contractual relationship.
The commercial outlook remains dependent on actual procurements. CISA’s directive does not itself establish a government-wide equipment recovery contract or guarantee third-party service revenue.
Providers considering federal network disposition capabilities should examine solicitation requirements and contract modifications before committing resources.
Unsupported equipment presents a difficult reuse market
Network hardware can retain value through continued use or component recovery, particularly where maintenance providers need replacement assemblies for equipment still operating within supported environments.
End-of-support status changes the commercial assessment. A functioning firewall or router may have limited value for reuse if its manufacturer no longer provides the security updates required to address vulnerabilities.
This creates a different valuation problem from ordinary enterprise equipment replacement.
A laptop retired because of age may remain suitable for a secondary buyer when its software and hardware continue to receive appropriate support. A network security appliance retired specifically because of unsupported firmware can face additional restrictions.
Some devices may retain value through replaceable components or materials recovery. Other equipment could have legitimate uses in carefully controlled environments, subject to independent evaluation.
The fact that hardware powers on does not establish that it can be safely redeployed.
For government sustainability and property management teams, these considerations reinforce the importance of accurately recording final equipment destinations.
Transfer and refurbishment outcomes should reflect the equipment’s actual supportability. Devices that cannot return to productive service may require responsible recycling.
Recycling volumes depend on authorized equipment releases
Network edge devices contain electronic assemblies and other materials that can enter established electronics recycling processes.
The composition varies among equipment categories. Smaller network appliances and larger infrastructure equipment differ in physical construction and recoverable material content.
Device counts alone therefore provide limited information about potential recycling revenue.
The absence of a publicly available CISA device list further restricts market estimates. Agencies must compile inventories, but the directive does not publish a government-wide equipment total or an estimate of material recovery volumes.
Replacement schedules could also vary among agencies depending on their network configurations and existing support contracts.
Downstream processors should seek equipment information from authorized suppliers. Confirmed quantities and material weights provide a sounder basis for processing forecasts than the number of agencies covered by the directive.
A large federal compliance program can create equipment-management activity without producing an equivalent quantity of immediately available recycling material.
Industry Outlook
CISA’s directive establishes a timetable for retiring unsupported network edge devices within covered federal systems.
The February and August 2027 deadlines could concentrate replacement activity among agencies with affected equipment, while the February 2028 requirement introduces ongoing discovery and decommissioning obligations.
For ITAD providers, secure decommissioning services represent a potential commercial activity. Access to the equipment itself will depend on procurement arrangements and federal property disposition decisions.
Companies able to work with network integration contractors and authorized property managers could be better positioned to participate than firms relying entirely on purchases of retired hardware.
Downstream recycling volumes remain unknown. The initial CISA device list is not public, and the directive does not provide the quantities or equipment types necessary to estimate recoverable materials.
Agency inventories and completed retirement records will offer a more dependable basis for market assessment than cybersecurity deadlines alone.
For federal CIOs and sustainability executives, the directive also provides a reason to coordinate technology replacement planning with property management.
Reliable records connecting retired network devices with their final disposition can help agencies assess the financial and environmental results of their modernization programs.
Strategic Recommendations
ITAD providers and government contractors
Map procurement and disposition responsibilities. Identify organizations responsible for network decommissioning and those authorized to determine the final disposition of equipment. Examine existing government technology contracts for potential subcontracting opportunities.
Develop secure network-device handling procedures. Establish model-appropriate controls for configuration information and authentication material. Support equipment transfers with serialized tracking and documented sanitization where required.
Qualify opportunities through actual solicitations. Monitor federal procurement announcements and contract modifications associated with network hardware replacement. Distinguish confirmed service requirements from anticipated equipment recovery revenue.
Federal ITAM, cybersecurity and sustainability executives
Connect cybersecurity inventories with property records. Ensure that devices removed from networks can be reconciled with equipment disposition documentation. Include applicable contractor-held assets in the planning process.
Clarify responsibilities in modernization contracts. Specify who performs secure equipment removal and which organization retains accountability for government property. Establish documentation requirements before work begins.
Evaluate equipment reuse eligibility. Consider vendor support status and cybersecurity restrictions before authorizing transfers for continued use.
Downstream electronics recyclers
Build relationships with authorized federal disposition channels. Establish how equipment becomes available following applicable property screening and security procedures. Do not assume that decommissioning contractors can independently sell government-owned hardware.
Forecast supply from confirmed equipment releases. Obtain equipment descriptions and quantities before allocating processing capacity. Treat government-wide deadlines as indicators of possible commercial activity rather than guaranteed recycling volume.
Sources
- CISA — Binding Operational Directive 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026
- GAO — Modernizing Critical Legacy Systems, July 17, 2025
- GAO — Technology Modernization Fund, July 23, 2026
- Federal Acquisition Regulation — Part 45: Government Property
- Federal Acquisition Regulation — 45.602-2: Reutilization Priorities
- GSA — Federal Management Regulation Bulletin B-34: Disposal of Federal Electronic Assets
- GSA — Electronic Waste and Federal Property Management
- GovCIO Media & Research — CISA Tells Agencies to Remove These Vulnerable Edge Devices, March 6, 2026