Historically, the federal government has had difficulties acquiring, developing, and managing IT investments. Further, federal agencies have struggled with appropriately planning and budgeting for modernizing legacy systems; upgrading underlying infrastructure; and investing in high quality, lower cost service delivery technology. The consequences of not updating legacy systems has contributed to, among other things, security risks, unmet mission needs, staffing issues, and increased costs. Security risks. Legacy systems may operate with known security vulnerabilities that are either technically difficult or prohibitively expensive to address. In some cases, vendors no longer provide support for hardware or software, creating security vulnerabilities and additional costs. For example, in November 2017, the Department of Education’s (Education) Inspector General identified security weaknesses that included the department’s use of unsupported operating systems, databases, and applications. By using unsupported software, the department put its sensitive information at risk, including the personal records and financial information of millions of federal student aid applicants. Unmet mission needs. Legacy systems may not be able to reliably meet mission needs because they are outdated or obsolete. For instance, in 2016, the Department of State’s (State) Inspector General reported on the unreliability of the Bureau of Consular Affairs’ legacy systems. Specifically, during the summers of 2014 and 2015, outages in the legacy systems slowed and, at times, stopped the processing of routine consular services such as visa processing. For example, in June 2015, system outages caused by a hardware failure halted visa processing for 13 days, creating a backlog of 650,000 visas. Staffing issues. In order to operate and maintain legacy systems, staff may need experience with older technology and programming languages, such as the Common Business Oriented Language (COBOL). Agencies have had difficulty finding employees with such knowledge and may have to pay a premium to hire specialized staff or contractors. For example, we reported in May 2016 that the Social Security Administration (SSA) had to rehire retired employees to maintain its COBOL systems. Further, having a shortage of expert personnel available to maintain a critical system creates significant risk to an agency’s mission. For instance, we reported in June 2018 that the Internal Revenue Service (IRS) was experiencing shortages of staff with the skills to support key tax processing systems that used legacy programming languages. These staff shortages not only posed risks to the operation of the key tax processing systems, but they also hindered the agency’s efforts to modernize its core tax processing system. Increased costs. The cost of operating and maintaining legacy systems increases over time. The issue of cost is linked to the three previously described consequences—either because the other issues directly raise costs or, as in the case of not meeting mission needs, the agency is not receiving a favorable return on investment. Further, in an era of constrained budgets, the high costs of maintaining legacy systems could limit agencies’ ability to modernize and develop new or replacement systems. During the course of our review, agencies reported that they consider several factors prior to deciding whether to modernize a legacy system. In particular, agencies evaluate factors, such as the inherent risks, the criticality of the system, the associated costs, and the system’s operational performance. Risks. Agencies consider the risks associated with maintaining the legacy system as well as modernizing the legacy system. For instance, agencies may prioritize the modernization of legacy systems that have security vulnerabilities or software that is unsupported by the vendor. However, limited system accessibility may also reduce the need to modernize a legacy system. For example, air-gapped systems, which are systems that are isolated from the internet, may mitigate a legacy system’s cybersecurity risk by preventing remote hackers from having system access. Conversely, we have also reported that air-gapped systems are not necessarily secure: they could potentially be accessed by other means than the internet, such as through Universal Serial Bus devices. Even so, removing the threat of remote access is a mitigation technique used by agencies such as the Nuclear Regulatory Commission (NRC). According to NRC, the agency reduced the riskiness of using computers with unsupported operating systems by putting these computers on isolated networks or by disconnecting them from networks entirely. Criticality. Agencies consider how critical the system is to the agency’s mission. Several agencies stated that they would consider how essential a legacy system is to their agencies’ missions before deciding to modernize it. For example, the Department of Health and Human Services (HHS) stated that, when deciding to modernize a legacy system, it considers the degree to which core mission functions of the agency or other agencies are dependent on the system. Similarly, Department of Energy (Energy) officials noted that the department is required to maintain several legacy systems associated with the storage of its nuclear waste. Costs. Agencies consider the costs of maintaining a legacy system and modernizing the system. For example, according to the Department of Veterans Affairs (VA), there are systems for which a life-cycle cost analysis of the legacy system may show that the cost to modernize exceeds the projected costs to maintain the system. Similarly, the Department of Defense (DOD) noted that, before deciding on a modernization solution, it is important to assess the costs of the transition to a new or replacement solution. An agency also may decide to modernize a system when there is potential for cost savings to be realized with a modernization effort. For example, HHS stated that it may pursue the modernization of a legacy system if the department anticipates reductions in operations and maintenance costs due to efficiencies gained through the modernization. Performance. Before making the decision to modernize, agencies consider the legacy system’s operational performance. Specifically, if the legacy system is performing poorly, the agency may decide to modernize it. For example, the Department of Transportation (Transportation) stated that, if a legacy system is no longer functioning properly, it should be modernized. In addition, HHS noted that the ability to improve the functionality of the legacy system could be a reason to modernize it. As previously mentioned, in May 2016, we reported that federal legacy IT investments were becoming increasingly obsolete. In this regard, agencies had reported operating systems that used outdated languages and old parts, which were difficult to replace. Further, we noted that each of the 12 selected agencies had reported using unsupported operating systems and components, which could create security vulnerabilities and additional costs. At the time, five of the selected agencies reported using 1980s and 1990s Microsoft operating systems that stopped being supported by the vendor more than a decade ago. We concluded that agencies were, in part, maintaining obsolete investments because they were not required to identify, evaluate, and prioritize investments to determine whether the investments should be kept as-is, modernized, replaced, or retired. We pointed out that the Office of Management and Budget (OMB) had created draft guidance that would require agencies to do so, but OMB had not committed to a firm time frame for when the guidance would be issued. As such, we made 16 recommendations to OMB and the selected federal agencies to better manage legacy systems and investments. Most agencies agreed with the recommendations or had no comment. However, as of May 2019, 13 recommendations had not been implemented. In particular, OMB has not finalized and issued its draft guidance on legacy systems. Until this guidance is finalized and issued, the federal government will continue to run the risk of maintaining investments that have outlived their effectiveness and are increasingly difficult to protect from cybersecurity vulnerabilities. Congress and the executive branch have initiated several efforts to modernize federal IT, including: Identification of High Value Assets. In a December 2016 memorandum, OMB observed that continued increases in computing power combined with declining computing and storage costs and increased network connectivity had expanded the government’s capacity to store and process data. However, OMB noted that this rise in technology and interconnectivity also meant that the federal government’s critical networks, systems, and data were more exposed to cyber risks. As a result, OMB issued guidance to assist federal agencies covered by the Chief Financial Officers Act in managing the risks to these assets, which it designated as High Value Assets. Subsequently, in December 2018, OMB issued a memorandum that provided further guidance regarding the establishment and enhancement of the High Value Asset program. It stated that the program is to be operated by DHS in coordination with OMB. Further, the new guidance expanded the program to apply to all agencies (i.e., agencies covered by the Chief Financial Officers Act, as well as those not covered by the act) and expanded the definition of High Value Assets. The guidance required agencies to identify and report these assets (which may include legacy systems), assess them for security risks, and remediate any weaknesses identified, including those associated with obsolete or unsupported technology. Assessment of federal IT modernization. On May 11, 2017, the President signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This executive order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cybersecurity threats. Among other things, the order tasked the Director of the American Technology Council to coordinate a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration (GSA), in consultation with the Secretary of Commerce, regarding modernizing federal IT. As a result, the Report to the President on Federal IT Modernization was issued on December 13, 2017, and outlined the current and envisioned state of federal IT. The report focused on modernization efforts to improve the security posture of federal IT and recognized that agencies have attempted to modernize systems but have been stymied by a variety of factors, including resource prioritization, ability to procure services quickly, and technical issues. The report provided multiple recommendations intended to address these issues through the modernization and consolidation of networks and the use of shared services. In particular, the report recommended that the federal government prioritize the modernization of legacy IT by focusing on enhancing security and privacy controls for those assets that are essential for agencies to serve the American people and whose security posture is most vulnerable (i.e., High Value Assets). Enactment of the Modernizing Government Technology (MGT) Act. To help further agencies’ efforts to modernize IT, in December 2017, Congress and the President enacted a law to authorize the availability of funding mechanisms to improve, retire, or replace existing IT systems to enhance cybersecurity and to improve efficiency and effectiveness. The law, known as the MGT Act, authorizes agencies to establish working capital funds for use in transitioning from legacy systems, as well as for addressing evolving threats to information security. The law also created the Technology Modernization Fund, within the Department of the Treasury (Treasury), from which agencies can “borrow” money to retire and replace legacy systems, as well as acquire or develop systems. Subsequently, in February 2018, OMB issued guidance for agencies to implement the MGT Act. The guidance was intended to provide agencies additional information regarding the Technology Modernization Fund, and the administration and funding of the related IT working capital funds. Specifically, the guidance allowed agencies to begin submitting initial project proposals for modernization on February 27, 2018. In addition, in accordance with the MGT Act, the guidance provides details regarding a Technology Modernization Board, which is to consist of (1) the Federal CIO; (2) a senior official with IT technical expertise from GSA; (3) a member of DHS’s National Protection and Program Directorate; and (4) four federal employees with technical expertise in IT development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director of OMB. As of February 2019, the Technology Management Fund Board had approved funds for seven IT modernization projects across five agencies: the Department of Agriculture, Energy, the Department of Housing and Urban Development (HUD), the Department of Labor, and GSA. For example, the board approved $20 million for HUD to modernize a mainframe and five COBOL-based applications that are expensive to maintain. According to the board’s website, without these funds, HUD would not have been able to pursue this project for several years. Issuance of the President’s Management Agenda. In March 2018, the Administration issued the President’s Management Agenda, which lays out a long-term vision for modernizing the federal government. The agenda identifies three related drivers of transformation—IT modernization; data, accountability, and transparency; and the workforce of the future—that are intended to push change across the federal government. The President’s Management Agenda identifies 14 related Cross- Agency Priority goals, many of which have elements that involve IT. In particular, the Cross-Agency Priority goal on IT modernization states that modern technology must function as the backbone of how government serves the public in the digital age. Further, the goal on IT modernization provides three priorities that are to guide the Administration’s efforts to modernize federal IT: (1) enhancing mission effectiveness by improving the quality and efficiency of critical services, including the increased utilization of cloud-based solutions; (2) reducing cybersecurity risks to the federal mission by leveraging current commercial capabilities and implementing cutting edge cybersecurity capabilities; and (3) building a modern IT workforce by recruiting, reskilling, and retaining professionals able to help drive modernization with up-to-date technology. As determined by our review of 65 critical federal legacy systems (see appendix II), the 10 most critical legacy systems in need of modernization are maintained by 10 different federal agencies whose missions are essential to government operations, such as emergency management, health care, and wartime readiness. These legacy systems provide vital support to the agencies’ missions. According to the agencies, these legacy systems range from about 8 to 51 years old and, collectively, cost approximately $337 million annually to operate and maintain. Several of the systems use older languages, such as COBOL and assembly language code. However, as we reported in June 2018, reliance on assembly language code and COBOL has risks, such as a rise in procurement and operating costs, and a decrease in the availability of individuals with the proper skill sets. Further, several of these legacy systems are also operating with known security vulnerabilities and unsupported hardware and software. For example, DHS’s Federal Emergency Management Agency performed a security assessment on its selected legacy system in September 2018. This review found 249 reported vulnerabilities, of which 168 were considered high or critical risk to the network. With regard to unsupported hardware and software, Interior’s system contains obsolete hardware that is not supported by the manufacturers. Moreover, the system’s original hardware and software installation did not include any long-term vendor support. Thus, any original components that remain operational may have had long-term exposure to security and performance weaknesses. Table 1 provides a generalized list of each of the 10 most critical legacy systems that we identified, as well as agency-reported system attributes, including the system’s age, hardware’s age, system criticality, and security risk. (Due to sensitivity concerns, we substituted a numeric identifier for the system names and are not providing detailed descriptions). Appendix III provides additional generalized agency- reported details on each of these 10 legacy systems. Given the age of the hardware and software in legacy systems, the systems’ criticality to agency missions, and the security risks posed by operating aging systems, it is imperative that agencies carefully plan for their successful modernization. Documenting modernization plans in sufficient detail increases the likelihood that modernization initiatives will succeed. According to our review of government and industry best practices for the modernization of federal IT, agencies should have documented modernization plans for legacy systems that, at a minimum, include three key elements: (1) milestones to complete the modernization, (2) a description of the work necessary to modernize the legacy system, and (3) details regarding the disposition of the legacy system. Of the 10 identified agencies with critical systems most in need of modernization, seven (DOD, DHS, Interior, Treasury, the Office of Personnel Management (OPM), the Small Business Administration (SBA), and SSA) had documented modernization plans for their respective critical legacy systems and three did not have documented plans. The three agencies that did not have documented modernization plans for their critical legacy systems were: (1) Education, (2) HHS, and (3) Transportation. Of the seven agencies with documented plans, DOD and Interior had modernization plans that addressed each of the three key elements. For example, Interior submitted documentation of both completed and forthcoming milestones leading to the deployment of the modernized system. The department also provided a list of the mandatory requirements for the updated system, as well as the work that needed to be performed at each stage of the project, including the disposition of the legacy system. Likewise, DOD provided documentation of the milestones and the work needed to complete the modernization of its legacy system. In addition, the documentation discussed the department’s plans for the disposition of the legacy system. While the other five agencies—Treasury, DHS, OPM, SBA, and SSA— had developed modernization plans for their respective legacy systems, their plans did not fully address one or more of the three key elements. For instance, DHS’s Federal Emergency Management Agency’s modernization plan for its selected legacy system described the work that the department needed to accomplish, but did not include the associated milestones or the disposition of the legacy system. Similarly, SBA included milestones and a plan for the disposition of the legacy system, but did not include a description of the work necessary to accomplish the modernization. Treasury, OPM, and SSA partially included one or more of the key elements in their modernization plans. For instance, OPM’s and SSA’s plans included upcoming milestones for one part of the initiative, but not the entire effort. Similarly, OPM’s modernization plans only described a portion of the work necessary to complete each modernization initiative. Further, none of these four agencies’ modernization plans included considerations for the disposition of legacy system components following the completion of the modernization initiatives. While agencies may be using development practices that minimize initial planning, such as agile, agencies should have high-level information on cost, scope, and timing. Table 2 identifies the seven agencies with documented modernization plans for their critical systems, as well as the extent to which the plans were sufficiently detailed to include the three key elements. (Due to sensitivity concerns, we substituted a numeric identifier for the system names.) The agencies provided a variety of explanations for the missing modernization plans. For example, according to the three agencies without documented modernization plans: Education’s modernization plans were pending the results of a comprehensive IT visualization and engineering project that would determine which IT systems and services could be feasibly modernized, consolidated, or eliminated; HHS had entered into a contract to begin a modernization initiative but had not yet completed its plans; and Transportation had solicited information from industry to determine whether the agency’s ideas for modernization were feasible. Of the five agencies which had plans that lacked key elements, officials within SSA’s office of the CIO stated that the agency has yet to complete its modernization planning, even though modernization efforts are currently underway. The officials said that they will update the planning documentation and make further decisions as the modernization effort progresses. Officials within DHS’s Federal Emergency Management Agency’s Office of the CIO stated that its plans for modernizing the system we reviewed (System 4) are contingent on receiving funding and being able to allocate staffing resources to planning activities. According to the officials, the agency is also integrating its plans for modernizing System 4 with the management of the rest of the agency’s systems. Similarly, Treasury officials stated that IRS’s efforts to complete planning for the remaining modernization activities have been delayed due to budget constraints. In addition, officials within OPM’s Office of the CIO stated that its modernization plan did not extend to fiscal year 2019 because there were changes in leadership during the creation of the plan, and because of uncertainty in funding amounts. While we recognize that system modernizations are dependent on funding, it is important for agencies to prioritize funding for the modernization of these critical legacy systems. In addition, Congress provided increased authority for agencies to fund such modernization efforts through the MGT Act’s Technology Modernization Fund and the related IT working capital funds. Until the agencies establish complete legacy system modernization plans that include milestones, describe the work necessary to modernize the system, and detail the disposition of the legacy system, the agencies’ modernization initiatives will have an increased likelihood of cost overruns, schedule delays, and overall project failure. Project failure would be particularly detrimental in these 10 cases, not only because of wasted resources, but also because it would prolong the lifespan of increasingly vulnerable and obsolete systems, exposing the agency and system clients to security threats and potentially significant performance issues. Further, agencies may not be effectively planning for the modernization of legacy systems, in part, because they are not required to. As we reported in May 2016, agencies are not required to identify, evaluate, and prioritize existing IT investments to determine whether they should be kept as-is, modernized, replaced, or retired. We recommended that OMB direct agencies to identify legacy systems needing to be replaced or modernized. As of April 2019, OMB had not implemented this recommendation. OMB staff stated that agencies were directed to manage the risk to High Value Assets associated with legacy systems in OMB’s December 2018 guidance. While OMB’s guidance does direct agencies to identify, report, assess, and remediate issues associated with High Value Assets, it does not require agencies to do so for all legacy systems. Until OMB requires agencies to do so, the federal government will continue to run the risk of continuing to maintain investments that have outlived their effectiveness. The 24 Chief Financial Officers Act agencies in our review identified a total of 94 examples of successful modernizations of legacy systems undertaken in the last 5 years. The initiatives were of several types, including those aimed at transforming legacy code into a more modern programming language, migrating legacy services (e.g., email) to the cloud, and re-designing a legacy mainframe to a cloud-based application. Among these examples, the five that we selected reflect a mix of different agencies, types of system modernization initiatives, and types of benefits realized from the initiatives. Table 3 provides details on the five examples of successful IT modernization initiatives, as reported by their respective agencies, as well as the reported benefits related to those initiatives. The five agencies attributed the success of their modernization initiatives to various factors, including: using automated technologies to examine programming code and perform testing (DOD and Treasury); testing the system thoroughly (SSA and Treasury); actively engaging the end users and stakeholders throughout the modernization process (SSA and Treasury); cultivating a partnership between industry and government (DOD); following management practices on change and life cycle management (Education); developing and implementing an enterprise-wide cost collection and data analysis process for commodity IT to track and measure progress against consolidation, optimization, and savings targets (DHS); creating an interface that was consistent across systems (SSA); having strong executive leadership and support (Treasury); and using agile principles to facilitate the team’s ownership of the project (Treasury). These factors are largely consistent with government and industry best practices. For example, we reported in 2011 on critical success factors associated with major acquisitions, including engaging stakeholders and having the support of senior executives. Similarly, OMB’s guidance on High Value Assets calls for agencies’ plans to address change management and life cycle management. Likewise, the Software Engineering Institute’s Capability Maturity Model® Integration for Development recommends that organizations engage stakeholders, practice effective change and life cycle management, and thoroughly test systems, among other practices. Further, our Information Technology Investment Management framework recommends involving end users, implementing change and life cycle management processes, and obtaining the support of executive leadership. Agencies that follow such practices are better positioned to modernize their legacy systems. Doing so will also allow the agencies to leverage IT to successfully address their missions. The 10 most critical federal legacy systems in need of modernization are becoming increasingly obsolete. Several agencies are using outdated computer languages, which can be difficult to maintain and increase costs. Further, several of these legacy systems are also operating with unsupported hardware and software and known security vulnerabilities. Most agencies did not have complete plans to modernize these legacy systems. Due to the criticality and possible cybersecurity risks posed by operating aging systems, having a plan that includes how and when the agency plans to modernize is vital. In the absence of such plans, the agencies increase the likelihood of cost overruns, schedule delays, and overall project failure. Such outcomes would be particularly detrimental because of the importance of these systems to agency missions. Successfully modernizing legacy systems is possible, as demonstrated by the five highlighted examples. Agencies attributed the success of their modernization initiatives to a variety of management and technical factors that were consistent with best practices. In the LOUO report that we are issuing concurrently with this report, we are making a total of eight recommendations to eight federal agencies to identify and document modernization plans for their respective legacy systems, including milestones, a description of the work necessary, and details on the disposition of the legacy system. We requested comments on a draft of this report from OMB and the 24 agencies included in our review. The eight agencies to which we made recommendations in the LOUO report agreed with our findings and recommendations. In addition, OMB and the 16 agencies to which we did not make recommendations either agreed with our findings, did not agree or disagree with the findings, or stated that they had no comments. Further, multiple agencies provided technical comments, which we have incorporated, as appropriate. The following eight agencies agreed with our recommendations: In written comments from Education, the agency stated that it concurred with the recommendation and indicated its intent to address it. Education’s comments are reprinted in appendix IV. In written comments from HHS on the LOUO version of this report, the agency stated that it concurred with the recommendation and intends to evaluate ways to provide its modernization plan, including milestones and a description of the work necessary to modernize the system. HHS also provided technical comments that we incorporated, as appropriate. HHS deemed some of the information in its original agency comment letter pertaining to particular legacy systems to be sensitive, which must be protected from public disclosure. Therefore, we have omitted the sensitive information from the version of the agency comment letter that is reprinted in appendix V of this report. In written comments, DHS stated that it concurred with our recommendation. DHS’s comments are reprinted in appendix VI. In comments received via email from Transportation’s Director of Audit Relations and Program Improvement on May 9, 2019, the agency stated that it agreed with our recommendation. In comments from Treasury’s Supervisory IT Specialist/Performance and Governance Analyst, received via email on May 17, 2019, the department stated that it agreed with our recommendation. In addition, Treasury’s component agency, IRS, provided written comments which stated that it agreed with the recommendation. The agency said it intends to develop a multiyear retirement strategy for its system to address the recommendation. In its written comments, IRS also stated that our draft report did not accurately convey that the legacy system replacement project is intended to only replace core components of its selected legacy system. The agency said that, even when the entire replacement project is completed, it will only address a portion of the work required to retire the legacy system. In response, we modified our discussion of this project in the report. IRS’s comments are reprinted in appendix VII. In written comments from OPM on the LOUO version of this report, the agency stated that it concurred with the recommendation and indicated its plans to address the recommendation. OPM also provided technical comments that we incorporated, as appropriate. OPM deemed some of the information in its original agency comment letter pertaining to particular legacy systems to be sensitive, which must be protected from public disclosure. Therefore, we have omitted the sensitive information in the version of the agency comment letter that is reprinted in appendix VIII. In written comments, SBA concurred with our recommendation and stated that it intends to include a description of the work necessary to modernize the legacy system in the initiative’s project plan. The agency estimated that it will address the recommendation by July 31, 2019. SBA deemed some of the information in its original agency comment letter pertaining to particular legacy systems to be sensitive, which must be protected from public disclosure. Therefore, we have omitted the sensitive information from the version of the agency comment letter that is reprinted in appendix IX. In written comments from SSA, the agency stated that it agreed with our recommendation. The agency added that it is modernizing its legacy system using agile software methods and a multiyear roadmap of development activities. The agency further stated that, as it completes its modernization work, it expects to retire most of the legacy software associated with System 10. SSA also provided technical comments that we incorporated, as appropriate. SSA’s comments are reprinted in appendix X. In addition, we received responses via email from 14 agencies to which we did not make recommendations. Of these agencies, three agreed with our findings and 11 stated that they did not have comments on the report. Two other agencies—HUD and the U.S. Agency for International Development—provided written comments in which they expressed appreciation for the opportunity to review the report, but did not state whether they agreed or disagreed with our findings. These agencies’ comments are reprinted in appendixes XI and XII, respectively. Further, in an email from OMB staff on May 22, 2019, the agency did not state whether it agreed or disagreed with our findings, but provided technical comments that we incorporated, as appropriate. We are sending copies of this report to the appropriate congressional committees; the Secretaries of the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, Labor, State, the Interior, the Treasury, Transportation, and Veterans Affairs; the U.S. Attorney General (Department of Justice); the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, Small Business Administration, and the U.S. Agency for International Development; the Commissioner of the Social Security Administration; the Directors of the National Science Foundation and the Office of Personnel Management; and the Chairman of the Nuclear Regulatory Commission; and other interested parties. This report is also available at no charge on the GAO website at http://www.gao.gov. Should you or your staffs have any questions on information discussed in this report, please contact me at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix XIII. Our objectives were to (1) identify the most critical federal legacy systems in need of modernization and evaluate plans for modernizing them, and (2) identify examples of information technology (IT) legacy system modernization initiatives in the last 5 years that agencies considered successful. The scope of our review included the 24 agencies covered by the Chief Financial Officers Act of 1990. This report presents a public version of a “limited official use only” (LOUO) report that we are also issuing today. The Department of Homeland Security and the Department of the Interior determined that certain information in our original report should be protected from public disclosure. Therefore, we will not release the LOUO report to the general public because of the sensitive information it contains. The LOUO report includes eight recommendations that we made to eight agencies to document modernization plans for particular legacy systems, including milestones, a description of the work necessary, and details on the disposition of the legacy system. In this public version of the report, we have omitted sensitive information regarding particular legacy systems. Specifically, we have deleted systems’ names and other information that would identify the particular system, such as specific descriptions of the systems’ purposes and vulnerabilities. Although the information provided in this report is more limited, the report addresses the same objectives as the LOUO report and is based on the same audit methodology. We provided a draft of this report to agency officials to obtain their review and comments on the sensitivity of the information contained herein. We confirmed with the agency officials that this report can be made available to the public without jeopardizing the security of federal agencies’ legacy systems. To identify the most critical legacy systems in need of modernization, we first reviewed the agencies’ 2017 responses to congressional committees’ requests for information that identified the agencies’ top three legacy systems in need of modernization. We then asked the agencies to either confirm that those systems were still considered their top systems in need of modernization or update their lists to include the three systems most in need of modernization. All 24 agencies either confirmed or updated their lists of legacy systems most in need of modernization. This resulted in a collective list of 65 systems. However, due to sensitivity concerns, we are not disclosing the names of the systems in this report. Appendix II provides a generalized list of the systems. To develop a set of attributes for determining systems’ obsolescence and their need for modernization, we reviewed available technical literature, such as: General Services Administration’s Unified Shared Services Management’s Modernization and Migration Management (M3) Playbook and M3 Playbook Guidance, American Technology Council’s Report to the President on Federal IT Modernization, Office of Management and Budget’s Management of Federal High IBM Center for The Business of Government’s A Roadmap for IT Modernization in Government, and American Council for Technology-Industry Advisory Council’s Legacy System Modernization: Addressing Challenges on the Path to Success. We also consulted with system development experts within GAO and reviewed our prior report on federal legacy systems. Using these sources, we developed a set of 14 total attributes for determining systems’ obsolescence and their need for modernization. We then asked the agencies in our review to provide the associated details for the selected systems. We considered these details to rank the systems against the attributes that we compiled. We assigned point values to each system based on the systems’ agency-reported attributes. Table 4 details the nine attributes and associated point values and ranges we used to initially rank the legacy systems. We then totaled the assigned points for each legacy system and ranked the results from highest to lowest number of assigned points. While we had planned to select the top 20 systems with the most points for more detailed analysis, three systems were ranked in nineteenth place. As a result, we selected 21 systems for our review. We collected additional information on the 21 selected systems and performed a second round of analysis, scoring, and ranking. Based on the second set of scores, we identified the 10 systems with the highest scores as being the most critical legacy systems in need of modernization. We also supplemented our review with interviews of officials in the agencies’ offices of the Chief Information Officer and program offices for the selected legacy systems. Table 5 details the five attributes and associated point values and ranges we used to rank the legacy systems in the subsequent round of analysis. Table 6 lists these 10 selected systems according to their designated identifiers. However, due to sensitivity concerns, we substituted a numeric identifier for the name of each system. To evaluate agencies’ plans for modernizing the 10 federal legacy systems most in need of modernization, we requested that agencies provide us with the relevant plans. These modernization plans could have been contained within several types of documentation, since a system modernization could be a new system development, a system acquisition, or a renovation of the legacy system. For example, if an agency was acquiring a new system from a vendor, the plans for modernization could have been contained within an acquisition plan or a statement of work in a contract. Likewise, if an agency was developing a new system on its own, the modernization plans could have been within a project plan or design document. We reviewed government and industry best practice documentation on the identification and modernization of legacy systems, including: General Services Administration’s Unified Shared Services Management’s Modernization and Migration Management (M3) Playbook and M3 Playbook Guidance, American Technology Council’s Report to the President on Federal Office of Management and Budget’s Management of Federal High IBM Center for The Business of Government’s A Roadmap for IT Modernization in Government, and American Council for Technology-Industry Advisory Council’s Legacy System Modernization: Addressing Challenges on the Path to Success. Based on our reviews of these sources, we determined that agencies’ documented plans for system modernization should include, at a minimum, (1) milestones to complete the modernization, (2) a description of the work necessary to modernize the system, and (3) details regarding the disposition of the legacy system. We then analyzed agencies’ documented modernization plans for the selected systems to determine whether the plans included these elements. If an agency’s plans included milestones for only a portion of the initiative or only described a portion of the work necessary to complete the modernization, we assigned the agency a partial rating. Appendix III provides details on each of the selected systems and the agencies’ plans for modernizing them. To identify examples of successful IT legacy system modernization initiatives, we first asked each of the 24 agencies to provide us with examples of their successful modernization initiatives completed between 2014 and 2018. The agencies reported 94 examples of successful modernization initiatives. We also reviewed the agencies’ responses to congressional committees’ requests for information to determine other possible successful modernization initiatives at these agencies. Using the examples discovered in this process and the agency-provided examples, we then collected and reviewed documentation describing the modernization initiatives, such as case studies and the agencies’ written responses to our questions about the initiatives. We used our professional judgment to select examples that reflected a mix of different agencies, types of system modernization initiatives, and types of benefits realized from the initiatives. We ultimately included in our review those modernization initiatives that two or more members of our audit team selected as examples that reflected a mix of different agencies, types of system modernization initiatives, and types of benefits realized from the initiatives. We also coordinated with the selected agencies’ Offices of Inspector General to determine whether those offices had any past or current audit work that would contradict the agencies’ determination that the selected initiatives were successful. We conducted this performance audit from January 2018 to June 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Each of the 24 Chief Financial Officers Act agencies identified their agency’s most critical legacy systems in need of modernization. The agencies identified a total of 65 such systems. The agencies also identified various attributes of the legacy systems, including the systems’ age, hardware age, system criticality, and security risk. Table 7 provides a generalized list of the most critical legacy systems in need of modernization, as identified by the agencies, as well as selected factors related to each system’s age and criticality. (Due to sensitivity concerns, we substituted alphanumeric identifiers for the names of the agencies’ systems. Specifically, we assigned a number to identify each of the 10 most critical legacy systems in need of modernization that we discuss in this report and we assigned a letter or letters to identify the remaining 55 systems.) This appendix describes the 10 most critical legacy systems in need of modernization, as identified during our review. The profiles of each system describe (1) the system’s purpose, (2) the reason that the system needs to be modernized, (3) the agency’s plans for modernization, and (4) possible benefits to be realized once the system is modernized. The Department of Defense (DOD)—U.S. Air Force’s System 1 provides configuration control and management to support wartime readiness and operational support of aircraft, among other things. See figure 1 for a photograph of airmen maintaining an aircraft. The Department of Education’s (Education) System 2 processes and stores student information and supports the processing of federal student aid applications. Education first implemented System 2 in 1973. Agency officials stated that the system runs approximately 1 million lines of Common Business Oriented Language (COBOL) on an IBM mainframe. COBOL is a legacy language that can be costly to maintain. The department noted that 18 contractors are employed to maintain the COBOL programming language for this and another system. Education officials stated that the agency would like to modernize System 2 to eliminate reliance on COBOL, simplify user interactions, improve integration with other applications, respond to changing business requirements more quickly, and decrease development and operational costs. Education officials stated that the agency intends to modernize System 2 as part of its Next Generation Financial Services Environment initiative. This initiative is to modernize Federal Student Aid’s technical and operational architecture and improve the customer experience. The agency expects to consolidate all customer-facing websites and implement a new loan servicing platform to benefit federal student loans. Education has not developed a plan for the modernization of System 2. According to agency officials, these plans are pending the results of a comprehensive information technology (IT) visualization and engineering project that will determine which IT systems and services could be feasibly modernized, consolidated, or eliminated. While Education has not calculated the specific cost savings associated with modernizing System 2, the department anticipates potential cost savings, including decreased hardware and software licensing costs and decreased costs associated with changes to business rules. According to the agency, other potential benefits of modernizing this system include integration across the enterprise, improved cybersecurity and data protection, reduced system complexity, and improved system efficiency. The Department of Health and Human Services’ (HHS) System 3 is a clinical and patient administrative information system. HHS’s component, Indian Health Service’s (IHS) uses the system to gather, store, and display clinical, administrative, and financial information on patients seen in a clinic, hospital, or remotely through the use of telehealth and home visit practices. HHS officials stated that the modernization of System 3 is imperative. Specifically, the agency noted that the system’s technical architecture and infrastructure were outdated. This has resulted in challenges in developing new capabilities in response to business and regulatory requirements. Further, System 3 is coded in C++ and MUMPS. MUMPS is a programming language that HHS considers to be a legacy language. The agency noted that it has become increasingly difficult to find programmers proficient in writing code for MUMPS. Lastly, the system’s more than 50 modules were added over time to address new business requirements. The software is installed on hundreds of separate computers, which has led to variations in the configurations at each site. According to IHS, this type of add-on development becomes detrimental over time and eventually requires a complete redesign to improve database design efficiency, process efficiency, workflow integration, and graphical user interfaces. While the agency does not yet have modernization plans, in September 2018, HHS awarded a contract to conduct research for modernizing IHS’s health information technology (IT) infrastructure, applications, and capabilities. According to the department, the research will be conducted in several stages over the next year, and a substantial part of the research will be an evaluation of the current state of health IT across IHS’s health facilities. Once the research is conducted, in consultation with IHS and its stakeholders, the contractor will use the findings and recommendations to propose a prioritized roadmap for modernization. According to HHS, the agency will be completing the modernization initiative over the next 5 years, but anticipated that it may be able to begin to execute an implementation plan as early as 2020. With regards to potential cost savings, HHS noted that the modernization will take significant capital investment to complete and it is unknown whether the modernization will lead to cost savings. HHS officials stated that this modernization could improve interoperability with its health care partners, the Department of Veterans Affairs and the Department of Defense, and significantly enhance direct patient care. The Department of Homeland Security—Federal Emergency Management Agency’s (FEMA) System 4 consists of routers, switches, firewalls, and other network appliances (all referred to as devices) to support the connectivity of FEMA sites. According to the agency, System 4 needs to be modernized because there are significant cyber and network vulnerability risks associated with its end of life (i.e., no longer supported or manufactured by the vendor) devices. In particular, the system’s devices typically require replacement every 3 to 5 years from the date of purchase. Despite this, the majority of the hardware was purchased between 8 and 11 years ago. As of December 2018, about 545 of these devices were at the end of life. In a security assessment report performed in September 2018, System 4 received 249 security findings, of which 168 were high or critical risk to the system. Further compounding this issue, the agency is not certain exactly how many devices make up the system. In particular, FEMA officials stated that the vendor completed an inventory of devices in May 2018, but that inventory did not align with other inventory counts. As a result, the agency plans to develop an inventory reconciliation strategy and process to address this issue. FEMA intends to replace System 4’s devices in two phases. The first phase will target the agency’s smaller facilities, while the second phase is to address the larger facilities, which may require more complex installations. FEMA’s Office of the Chief Information Officer is conducting site surveys to better define requirements and cost estimates. While the agency has yet to develop finalized modernization plans for this initiative with milestones, DHS officials and contract information technology staff developed a list of future recommended activities that would help modernize the system as part of their November 2018 quarterly business review. Despite the lack of finalized plans, FEMA intends to replace 240 of the 545 devices that are at the end of support, if funds are available. The agency also intends to upgrade the remaining 305 devices in the future, if funds are available. The agency has not calculated the exact amount of cost savings. Once the system is completely updated and a lifecycle replacement operations and maintenance support plan is in place and funded, FEMA and DHS expect to realize cost savings based on new technology and increased throughput. Further, the agency stated that with new equipment, it would be able to meet mission requirements and take advantage of new technologies. In addition, replacing these unsupported devices would significantly reduce downtime and increase network availability. The Department of the Interior’s (Interior) System 5 is an Industrial Control System (ICS) Supervisory Control and Data Acquisition (SCADA) System that supports the general operation of dams and power plants on a particular river and its tributaries. The system serves its customers by, among other things, starting and stopping the generators, adjusting the output of electricity to assure electric grid stability, and monitoring the operating conditions of dam and power plant equipment. Figure 2 shows an example of an Interior dam. The system is approximately 18 years old and contains obsolete hardware that is not supported by the manufacturers. Further, according to a program official, the system’s original hardware and software installation did not include any long-term vendor support. Thus, any original components that remain operational may have had long-term exposure to security and performance weaknesses. In January 2014, the Director of National Intelligence testified that ICS and SCADA systems used in electrical power distribution provided an enticing target to malicious actors and that, although newer architectures provide flexibility, functionality, and resilience, large segments of the systems remain vulnerable to attack, potentially causing significant economic or human impact. Further, according to Interior’s system modernization plans, the agency needs to modernize the system in order to increase data collection capabilities and security. Specifically, the system is expected to interface with more plant equipment and collect and report on more data than it has in the past. According to Interior’s plans, the modernized system is expected to accommodate future growth requirements. The plans also support the complete replacement of the system’s obsolete hardware and software. The modernization plans also outline goals, milestones, and the work to be accomplished. The agency plans to complete the modernization by January 2020. By replacing the legacy system, Interior plans to realize a number of potential benefits, including annual cost savings of $152,000. In addition, the system will no longer run on obsolete, unsupported hardware. Furthermore, newer software and hardware are expected to allow for the automation of compliance tasks, increase system security, and expand system availability. According to the system’s fiscal year 2017 operational analysis, these benefits should create a more reliable system for both the agency and the customers of the networked hydroelectric dams. The Department of the Treasury’s Internal Revenue Service’s (IRS) System 6 contains taxpayer data. Many IRS processes depend on output, directly or indirectly, from this data source. System 6 was written in a now outdated assembly language code and Common Business Oriented Language (COBOL). The department and we have raised a number of concerns related to this system’s reliance on assembly language code and COBOL, the maintainability of the system, and staff attrition. For example, in May 2016, we reported that legacy systems using outdated languages may become increasingly more expensive and agencies may pay a premium to hire staff or contractors with the knowledge to maintain these systems. IRS plans to address these concerns by modernizing core components of System 6. The new system is intended to provide improved functionality. However, IRS is having trouble fully staffing the modernization effort, resulting in significant delays. While the agency has developed modernization plans, they are incomplete. For example, the plans’ milestones do not go past the current project and their descriptions of the work necessary to complete the project are at a higher level when outlining the goals of future stages. In May 2019, the agency stated that even when the current modernization effort is fully implemented, only a portion of the work required to retire the legacy system will have been completed. The agency has not provided a target date for decommissioning the legacy system. While IRS does not anticipate cost savings associated with the modernization of this system, it anticipates many internal and external benefits for both the taxpayer and the agency. In particular, according to the IRS’s Fiscal Year 2019 Capital Investment Plan, the benefits of modernizing this system include: (1) increased agility of agency response to changing taxpayer priorities and legislation; (2) reduced IT costs and complexity; (3) enhanced analytics and reporting to greatly improve compliance and issue resolution; and (4) reduced burden of manually intensive processes on IRS employees, by enabling automated calculations that currently are not possible. The Department of Transportation’s (Transportation) Federal Aviation Administration’s (FAA) System 7 contains information on aircraft and pilots. The system also provides information to other government agencies, including those responsible for homeland security and investigations of aviation accidents. According to Transportation, the system is DOS-based and needs to be updated to continue to efficiently meet its mission. Specifically, some of the core system components are mainframe applications that have been in operation since 1984. In addition, the system is running unsupported software, including one operating system that was last supported by the vendor in 2010. FAA is planning to implement a new system to streamline processes, allow for the submission of electronic applications and forms, automate registration processes, improve data availability, and implement additional security controls. However, the agency does not currently have a documented modernization plan. Officials stated that the agency is seeking alternatives to modernize the system and meet legislative requirements. FAA has asked interested vendors to respond to a request for information. According to the agency, the responses to this request are intended to inform strategic decisions about the modernization, and are planned to ultimately lead to proposed solutions from industry. While FAA has not calculated the specific cost savings associated with modernizing the system, the agency stated that it anticipates potential cost savings. Agency officials stated that they plan to have information on the anticipated cost savings in November 2019. The agency also expects that the modernized system will provide enhanced security. The Office of Personnel Management’s (OPM) System 8 consists of the hardware, software, and service components that support OPM’s information technology (IT) applications and services. This system supports the agency’s business functions and supports the agency in providing investigative products and services for more than 100 federal agencies. Modernizing this system is especially important due to past security incidents and persistent security concerns. Specifically, according to OPM, segments of the agency’s infrastructure were allowed to age beyond end of life and now pose a significant risk in performance and security to IT operations. Further, in October 2017, OPM’s Office of the Inspector General (OIG) reported that the agency’s IT environment contained many instances of unsupported software and hardware, where the vendor no longer provided patches, security fixes, or updates for the software. As a result, the OIG noted that there was increased risk that OPM’s IT environment contained known vulnerabilities that would never be patched, and could have been exploited to allow unauthorized access to data. In June 2015, OPM reported that an intrusion into its systems had affected the personnel records of about 4.2 million current and former federal employees. Then, in July 2015, the agency reported that a separate but related incident had compromised its systems and the files related to background investigations for 21.5 million individuals. At a June 2015 Congressional hearing, OPM’s Director stated that the modernization of the IT infrastructure was critical to protecting the agency’s data from adversaries. The Director also stated that it was not feasible to implement encryption on networks that were too old, but noted that OPM was taking other steps to secure the networks. OPM plans to modernize System 8 by upgrading hardware at the end of life, migrating off of legacy operating systems and support software, and augmenting the agency’s established policies and procedures. In fiscal year 2018, OPM completed software and hardware upgrades, including replacement of core switches, network end points, and laptops. In fiscal year 2019, the agency plans to continue its focus on refreshing aged IT infrastructure, so that its hardware components will have the proper vendor support. OPM developed multiple documents related to the planning of this modernization effort, including a modernization schedule, and its fiscal year 2019 budget justification. However, the modernization plans contained in these documents did not include details for the entire modernization effort. The milestones in these documents, for instance, were either no longer current or only contained milestones regarding one part of the project. While the budget justification did outline what it planned to accomplish in fiscal years 2018 and 2019, it did not mention the rest of the work needed to complete the infrastructure modernization. Similarly, the OIG has reported concerns regarding the agency’s plans to modernize its infrastructure. Most recently, in June 2018, the OIG reported that OPM was generally continuing in the right direction toward modernizing its IT environment, but the OIG had concerns with the agency’s plan for modernization and its overall approach to IT modernization. For example, the OIG was concerned that OPM’s planning documents did not identify the full scope of the modernization effort or contain cost estimates for the individual initiatives or the effort as a whole. The OIG planned to monitor and continue to report on the agency’s progress in modernizing its infrastructure. OPM anticipates realizing both financial and nonfinancial benefits with the modernization of its infrastructure. For example, as a part of its overall infrastructure modernization, the agency avoided approximately $16 million in costs as part of its data center consolidation efforts for fiscal year 2018. The agency also expects that cybersecurity and operational risks associated with end of life hardware will be reduced. To that end, the agency stated that remediating end of life hardware also should allow OPM the ability to address identified security vulnerabilities and avoid operational downtime, as support is more readily available. The Small Business Administration’s (SBA) System 9 is a system that, according to the agency, provides identification, authentication, and authorization services for several of the agency’s applications. According to the agency, the system was developed by SBA and originally implemented in 2002. Agency officials stated that System 9’s hardware and software are no longer supported by the associated vendors. Consequently, according to the agency, it is paying for extended support contracts that have increased operating costs for the system. Further, agency officials stated that the system resides on a platform that is scheduled to be decommissioned within the next year. In addition, the system is coded using a programing language that the agency considers to be a legacy programming language (among others). The agency’s documented modernization plan includes milestones to complete the modernization and plans for the disposition of the legacy system following system modernization; however, the plan does not include a description of the work necessary to complete the modernization. However, agency officials stated that it intends to replace the system’s functionality with login.gov. Login.gov was developed and is maintained by the General Services Administration as a single sign-on trusted identity platform. Login.gov provides identification and authentication for applications and is intended to offer the public secure and private online access to participating government programs. However, according to the agency, since login.gov does not provide authorization controls, SBA intends to develop additional software to provide authorization controls beginning in March 2019. According to the agency, it does not anticipate any cost benefits from modernizing System 9. However, the agency expects that the security and stability of the system will increase. The Social Security Administration’s (SSA) System 10 supports the provision of particular Social Security benefits to eligible people. Currently, SSA collects detailed information from the recipients in person, by telephone, and via the internet on multiple platforms (e.g., desktops and hand-held devices), and from internal and external interface methods. System 10 is comprised of many applications that collect information, make payments, and communicate with SSA’s clients. According to SSA’s October 2017 information technology modernization plan, the agency needed to modernize its core systems, including System 10, because of complications related to their age and original system design. SSA’s modernization plan indicates that, since implementation, these systems had been subjected to constant modifications to incorporate changes in legislation, regulations, and policy. Through the years, new technologies and capabilities had been integrated into the core systems and delivering new capabilities was becoming exorbitantly expensive. Further, most of the agency’s systems, including System 10, are generally unconnected to each other, creating functional silos servicing independent lines of business. According to the agency, navigating these systems is challenging, and copying beneficiary data from system to system can result in data becoming out of sync. According to the agency’s modernization plan, SSA intends to replace its core systems, including System 10, with new components and platforms, engineered for usability, interoperability, and future adaptability. Work accomplished over several years of incremental modernization has already resulted in moving a substantial portion of System 10 away from old technologies. For instance, according to SSA officials in the Office of the Deputy Commissioner, Systems, SSA moved System 10 to a modern, relational database platform and modernized aspects of the user interface. According to an SSA 5-year modernization roadmap, the agency is currently working to modernize and create web services as a part of the effort to consolidate SSA’s initial claims processes; however, the roadmap does not offer specific information about these efforts. As for its modernization planning efforts, SSA’s plans include overall modernization goals, a high-level overview of the planned system architecture, milestones for fiscal year 2018, and a description of the work that it had planned to accomplish in fiscal year 2018. However, the plans do not include either System 10-specific milestones or a description of the work necessary to modernize the legacy system beyond fiscal year 2018. Further, the document does not include plans for the disposition of the legacy system after modernization. According to officials in the Office of the Deputy Commissioner, Systems, the agency will update the planning documentation and make further decisions as the modernization effort progresses. SSA expects that modernizing System 10 will result in cost savings in addition to many other benefits. For instance, the agency expects that it will be able to save approximately $38 million from modernizing System 10 and other systems running in the agency’s mainframe environment. In addition, increased staff access to benefit recipients’ data will enable staff to review medical evidence faster and process claims more accurately, among other things. According to the agency’s modernization plan, the improvements to the system should improve productivity and service to the public, as well as reduce the number of improper payments due to technician error. Error! No text of specified style in document. Appendix VIII: Comments from the Office of Personnel Management Error! No text of specified style in document. Appendix IX: Comments from the Small Business Administration Error! No text of specified style in document. Error! No text of specified style in document. Error! No text of specified style in document. Error! No text of specified style in document. Appendix XIII: GAO Contact and Staff Acknowledgments Error! No text of specified style in document. In addition to the contact name above, the following staff made key contributions to this report: Dave Powner (Director), Kevin Walsh (Assistant Director), Jessica Waselkow (Assistant Director), Chris Businsky, Rebecca Eyler, Angel Ip, and Meredith Raymond.
The federal government plans to spend over $90 billion in fiscal year 2019 on IT. About 80 percent of this amount is used to operate and maintain existing IT investments, including aging (also called legacy) systems. As they age, legacy systems can be more costly to maintain, more exposed to cybersecurity risks, and less effective in meeting their intended purpose. GAO was asked to review federal agencies' legacy systems. This report (1) identifies the most critical federal legacy systems in need of modernization and evaluates agency plans for modernizing them, and (2) identifies examples of legacy system modernization initiatives that agencies considered successful. To do so, GAO analyzed a total of 65 legacy systems in need of modernization that 24 agencies had identified. Of these 65, GAO identified the 10 most in need of modernization based on attributes such as age, criticality, and risk. GAO then analyzed agencies' modernization plans for the 10 selected legacy systems against key IT modernization best practices. The 24 agencies also provided 94 examples of successful IT modernizations from the last 5 years. In addition, GAO identified other examples of modernization successes at these agencies. GAO then selected a total of five examples to highlight a mix of system modernization types and a range of benefits realized. This is a public version of a sensitive report that is being issued concurrently. Information that agencies deemed sensitive has been omitted. Among the 10 most critical legacy systems that GAO identified as in need of modernization (see table 1), several use outdated languages, have unsupported hardware and software, and are operating with known security vulnerabilities. For example, the selected legacy system at the Department of Education runs on Common Business Oriented Language (COBOL)—a programming language that has a dwindling number of people available with the skills needed to support it. In addition, the Department of the Interior's system contains obsolete hardware that is not supported by the manufacturers. Regarding cybersecurity, the Department of Homeland Security's system had a large number of reported vulnerabilities, of which 168 were considered high or critical risk to the network as of September 2018. Of the 10 agencies responsible for these legacy systems, seven agencies (the Departments of Defense, Homeland Security, the Interior, the Treasury; as well as the Office of Personnel Management; Small Business Administration; and Social Security Administration) had documented plans for modernizing the systems (see table 2). The Departments of Education, Health and Human Services, and Transportation did not have documented modernization plans. Of the seven agencies with plans, only the Departments of the Interior and Defense's modernization plans included the key elements identified in best practices (milestones, a description of the work necessary to complete the modernization, and a plan for the disposition of the legacy system). Until the other eight agencies establish complete modernization plans, they will have an increased risk of cost overruns, schedule delays, and project failure. In the sensitive report, GAO is making a total of eight recommendations—one to each of eight agencies—to ensure that they document modernization plans for the selected legacy systems. The eight agencies agreed with GAO's findings and recommendations, and seven of the agencies described plans to address the recommendations.