The Tortoise, Not the Hare: Why Phased IT Modernization Wins

In the race to modernize federal legacy systems, agencies are learning that the tortoise often beats the hare, officials said Wednesday at GovCIO Media & Research’s Federal IT Efficiency Summit in Reston, Virginia. Rather than rushing large-scale IT overhauls, agencies are increasingly adopting phased modernization strategies designed to reduce risk, improve cybersecurity and better manage costs.

Legacy Challenges

Agencies modernizing legacy systems must account for both cyber and physical vulnerabilities, said Kevin Walsh, director of IT and cybersecurity at the Government Accountability Office.

Failing to update systems leaves organizations open to a variety of vulnerabilities. He noted that many federal agencies still operate systems with legacy programming languages such as COBOL. Besides being vulnerable to modern AI-powered attacks, there are other challenges — such as a lack of experienced staff — to keep them running.

“You may not have the people around who can maintain it anymore,” Walsh said. The maintenance thus results in higher costs.

Legacy systems can also hinder agencies’ ability to meet evolving mission requirements. As organizations grow and priorities shift, older technologies often cannot scale or adapt to support new operational demands. Walsh added that maintaining outdated infrastructure also drives up costs.

“All those things add up to spending money,” Walsh said.

Agencies can spend as much as 80% of their IT budgets on operations and maintenance to keep older systems running, said Justin Ubert, director of cyber protection with the Transportation Department. That leaves less than 20% of agency budgets available for development, modernization and enhancement efforts.

“That’s a huge sunk cost in terms of our systems that we’re maintaining and operating,” Ubert said.

Changing Approaches to Modernization

Officials said agencies are adopting new technologies and modernization strategies to help reduce some of the challenges associated with replacing legacy systems. Mangala Kuppa, CIO and chief AI officer at the Labor Department, said data migration is one of the most important — and often underestimated — components of modernization efforts.

“Your new system is not going to like your old data, and you can’t do it in the last minute,” noted Kuppa.

Kuppa also emphasized the need for agencies to adopt a continuous modernization mindset rather than treating modernization as a one-time effort. Under that approach, operations and maintenance evolve into ongoing preventive maintenance and “keeping the lights on,” while cybersecurity remains a central priority. She added that emerging technologies like AI can help agencies reverse engineer and document legacy systems.

“We have a unique opportunity to use technology to combat some of the traditional historic issues,” she said.

Amy Johanek, vice president of federal at Okta, said agencies should also take a phased approach to modernization rather than attempting large-scale “big bang” transitions all at once. Incremental modernization efforts can help agencies migrate data more effectively and reduce operational disruptions.

The most successful modernization projects, she said, are those that are “shovel-ready” and allow sufficient time for agencies to transition away from legacy systems, migrate data and conduct rigorous testing before deployment.