Agencies had finished modernizing three of the 10 critical legacy systems the Government Accountability Office (GAO) named in June 2019, as of February 2025. GAO's July 2025 follow-up, GAO-25-107795, ranked 11 systems now most in need, and only three of them had a modernization plan with all three elements GAO looks for. This post compares the paths agencies choose from in federal legacy system modernization and builds a plan checklist from GAO's own scoring of those plans.
Reading time:
7 min.
What did GAO find about federal legacy systems?
Slow progress on the 2019 list, and incomplete plans for most of the systems now most in need. Of the seven 2019 modernizations still open in February 2025, agencies planned to complete four within the next few years and two in five or more years; one had no planned completion date.
For the update, GAO asked the 24 agencies covered by the Chief Financial Officers (CFO) Act for their three legacy systems most in need of modernization, received 69, and scored them on 16 attributes, including age, vendor support, legacy languages, cybersecurity risk and operating cost. The top 11 are maintained by 10 agencies: Agriculture, Commerce, Defense, Energy, Health and Human Services, Homeland Security, Interior, Transportation, Treasury (two systems) and the Environmental Protection Agency (EPA). According to the agencies, the systems range from about 23 to 60 years old and cost about $754 million a year to operate and maintain. GAO did not publish their names.
The condition findings matter more than the ages. Eight of the 11 use outdated languages, four have unsupported hardware or software, and seven operate with known cybersecurity vulnerabilities. Both Treasury systems run on Common Business Oriented Language (COBOL) and Assembly Language Code, which GAO describes as languages with "a dwindling number of people available with the skills needed to support them." EPA's system has known vulnerabilities that GAO says "cannot be remediated without modernization."
Why do legacy systems stay in service?
Mostly because they still work, and replacing them competes for the same money as running them. GAO says the government spends more than $100 billion a year on IT and cyber-related investments, and agencies have typically reported spending about 80 percent on operations and maintenance (O&M) of existing IT.
Practice adds friction GAO's numbers don't show. The business rules live in the code and are rarely documented in full, so every rewrite risks changing a calculation that people depend on. The data carries decades of edge cases a new system has to accept. And cutover has to happen without interrupting payments, claims or benefits, which pushes teams toward long parallel runs that are easy to postpone.
Which federal legacy system modernization path fits?
The right path depends on what you most need to stop owning: the hardware, the language, the custom code or the system itself. Most portfolios use several paths, one system at a time.
| Path | What changes | What you still own | Fits when | Watch for |
|---|---|---|---|---|
| Rehost | Hosting and hardware; code runs as is on new infrastructure or an emulator | The code, the language and the skills gap | Hardware is unsupported or a facility is closing | Emulation licensing; the language problem is untouched |
| Replatform | Database, middleware or runtime moved to supported versions | Most of the application logic | The platform is the weak point and the code is sound | Behavior changes from new data types and batch timing |
| Refactor | Code converted or restructured into a current language and architecture | The business rules, now in maintainable code | The rules are worth keeping and you can build tests that prove them | Converted code that compiles but still reads like the old language |
| Replace | A commercial product, low-code build or new custom system | The data, configuration, integrations and your share of the security controls | The process is common across agencies or has changed | Data migration and process change are the real project |
| Retire | The function stops or moves into another system | Records and data retention obligations | Usage is low or another system already does the job | Hidden downstream users found at shutdown |
| Keep and wrap | New interfaces, portals or workflow built around a stable core | The core system, on purpose | The core is reliable and the pain is at the edges | Wrapping becomes the permanent plan by default |
Two cautions apply to every row. Any path that changes hosting, code or the system boundary needs security review, so the authorization schedule belongs in the plan from the start; our post on how long an ATO takes shows where that time goes. And a replacement with a commercial product starts with market research (see FAR Part 10 market research under the overhaul).
Improving the edges first can buy time to plan the core properly. On a HUD mortgage claims workflow, a low-code layer integrated with the existing systems of record cut processing from 17 months to 17 minutes, with no rip-and-replace. The risk in that approach is that a successful front end removes the pressure to deal with what sits behind it.
What does GAO expect in a modernization plan?
GAO looks for three elements: milestones to complete the modernization, a description of the work necessary to modernize the system, and details regarding the disposition of the legacy system. Nine of the 11 systems had documented plans. Only three, at Homeland Security, Interior and EPA, included all three elements. Defense and Energy had no plan for their selected systems.
GAO's table 5 shows where the other six plans, at Agriculture, Commerce, Health and Human Services, Transportation and Treasury (two), fell short:
| Plan element | Fully included | Partially included | Not included |
|---|---|---|---|
| Milestones to complete the modernization | 2 | 4 | 0 |
| Description of the work | 1 | 3 | 2 |
| Disposition of the legacy system | 0 | 5 | 1 |
Disposition is the element no incomplete plan fully covered, and it is the one that ends the spending. A plan that delivers a new system without a date to turn off the old one leaves the agency paying for both. GAO's warning applies to all three elements: until plans are fully documented, modernizations face "an increased likelihood of cost overruns, schedule delays, and overall project failure."
GAO says it recommended nearly a decade ago that the Office of Management and Budget (OMB) direct agencies to identify legacy systems, and that OMB has not yet taken action. In the 2025 report it asked Congress to consider "requiring major federal agencies to develop modernization plans for their legacy systems that have been identified as most in need of modernization." As of February 2026, GAO reported that legislative action had not yet occurred. The sensitive version of the report made eight recommendations to seven agencies; three agreed, three neither agreed nor disagreed, and one disagreed.
A modernization plan checklist
The list below starts from GAO's three elements and adds the items we would add from delivery experience. Use it before the acquisition strategy is final, since several items shape the statement of work.
- Milestones. Dated releases, the parallel-run window, the cutover date and the date O&M on the old system ends, with the contract actions each depends on.
- Description of the work. The path for each component (from the table above), the business rules to inventory and test, interfaces in and out, and the authorization approach for the new system.
- Disposition of the legacy system. Data migration and reconciliation criteria, records and retention obligations, license and hardware end dates, and the official who signs off that the old system can be turned off.
- Data. A profile of the legacy data and a reconciliation test written before code conversion or configuration starts.
- People. Who still understands the old system, how that knowledge gets captured, and what happens to the O&M team after cutover.
A system that can't yet answer item 3 has found its first task. Our modernization services page describes how we approach that sequencing alongside the engineering.
The Bottom Line
Pick the path system by system, based on what you need to stop owning, and write the plan GAO looks for before the first contract action: dated milestones, the work described, and a disposition date for the old system. If you are planning that work, our modernization team can help with the sequencing.
FAQ
What are the 10 most critical federal legacy systems?
GAO identified them in June 2019 but has not published their names for sensitivity reasons. Its July 2025 report (GAO-25-107795) says three of the 10 modernizations were complete as of February 2025. FedScoop reported those three were at the Small Business Administration, the Office of Personnel Management and the Department of Defense.
Why do federal agencies still use COBOL?
Many core transaction systems were written in COBOL decades ago, still process correctly, and are costly and risky to rewrite. GAO reported in 2025 that both of the Treasury systems it selected run on COBOL and Assembly Language Code, languages with a dwindling number of people available to support them.
How much of federal IT spending goes to legacy systems?
GAO says the federal government spends more than $100 billion a year on IT and cyber-related investments, and that agencies have typically reported spending about 80 percent of it on operations and maintenance of existing IT. That share covers all existing IT, not only systems GAO calls legacy.
How much do the 11 most critical legacy systems cost to run?
According to the agencies, about $754 million a year to operate and maintain, GAO reported in 2025. GAO ranked the 69 systems agencies submitted on 16 attributes, including age, vendor support, legacy languages, cybersecurity risk and operating cost.
Is rehosting a mainframe to the cloud real modernization?
It can be a sound first step when the hardware is unsupported or a data center is closing, but it leaves the code, the language skills problem and most of the technical debt in place. GAO counts outdated languages separately from unsupported hardware, and a rehost addresses only the second.
Sources
How we researched this. Every number, date and requirement here is checked against the sources listed above, primary documents first, and the post is fact-checked again before publication. When a rule, date or status changes, we update the post and log the change below. Read our editorial standards or send a correction.
About the author. Yahia Aboushadi is Director of Brand and Marketing at Pyramid Systems, an employee-owned federal IT firm in Fairfax, Virginia, that has delivered for federal agencies since 1995. More from Yahia Aboushadi. Connect on LinkedIn.
