INFORMATION 

TECHNOLOGY

Federal Agencies 

Need to Address 

Aging Legacy 

Systems

Report to Congressional Requesters

May 2016

GAO-16-468

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-468, a report to 

congressional requesters

May 2016

INFORMATION TECHNOLOGY

Federal Agencies Need to Address Aging Legacy 

Systems

What GAO Found

The federal government spent about 75 percent of the total amount budgeted for 

information technology (IT) for fiscal year 2015 on operations and maintenance 

(O&M) investments. Such spending has increased over the past 7 fiscal years, 

which has resulted in a $7.3 billion decline from fiscal years 2010 to 2017 in 

development, modernization, and enhancement activities.

Total Federal IT Spending by Type (in billions)

Specifically, 5,233 of the government’s approximately 7,000 IT investments are 

spending all of their funds on O&M activities. Moreover, the Office of 

Management and Budget (OMB) has directed agencies to identify IT O&M 

expenditures known as non-provisioned services that do not use solutions often 

viewed as more efficient, such as cloud computing and shared services. 

Agencies reported planned spending of nearly $55 billion on such nonprovisioned IT in fiscal year 2015. OMB has developed a metric for agencies to

measure their spending on services such as cloud computing and shared 

services, but has not identified an associated goal. Thus, agencies may be 

limited in their ability to evaluate progress.

Many O&M investments in GAO’s review were identified as moderate to high risk 

by agency CIOs, and agencies did not consistently perform required analysis of 

these at-risk investments. Further, several of the at-risk investments did not have 

plans to be retired or modernized. Until agencies fully review their at-risk 

investments, the government’s oversight of such investments will be limited and 

its spending could be wasteful.

Federal legacy IT investments are becoming increasingly obsolete: many use 

outdated software languages and hardware parts that are unsupported. 

Agencies reported using several systems that have components that are, in 

some cases, at least 50 years old. For example, Department of Defense uses 8-

inch floppy disks in a legacy system that coordinates the operational functions of 

the nation’s nuclear forces. In addition, Department of the Treasury uses 

assembly language code—a computer language initially used in the 1950s and 

typically tied to the hardware for which it was developed. OMB recently began an 

initiative to modernize, retire, and replace the federal government’s legacy IT 

systems. As part of this, OMB drafted guidance requiring agencies to identify, 

prioritize, and plan to modernize legacy systems. However, until this policy is 

Why GAO Did This Study

The federal government invests more 

than $80 billion on IT annually, with 

much of this amount reportedly spent 

on operating and maintaining existing 

(legacy) IT systems. Given the 

magnitude of these investments, it is 

important that agencies effectively 

manage their O&M.

GAO’s objectives were to (1) assess 

federal agencies’ IT O&M spending, (2) 

evaluate the oversight of at-risk legacy 

investments, and (3) assess the age 

and obsolescence of federal IT.

To do so, GAO reviewed OMB and 26 

agencies’ IT O&M spending for fiscal 

years 2010 through 2017. GAO further 

reviewed the 12 agencies that reported

the highest planned IT spending for 

fiscal year 2015 to provide specifics on 

agency spending and individual 

investments.

What GAO Recommends

GAO is making 16 recommendations, 

one of which is for OMB to develop a 

goal for its spending measure and

finalize draft guidance to identify and 

prioritize legacy IT needing to be 

modernized or replaced. GAO is also 

recommending that selected agencies 

address at-risk and obsolete legacy 

O&M investments. Nine agencies 

agreed with GAO’s recommendations, 

two agencies partially agreed, and two 

agencies stated they had no comment.

The two agencies that partially agreed, 

Defense and Energy, outlined plans 

that were consistent with the intent of 

our recommendations.

View GAO-16-468. For more information, 

contact David A. Powner at (202) 512-9286 or 

pownerd@gao.gov.
Federal Agencies Need to Address Aging Legacy Systems 

Highlights

finalized and fully executed, the government runs the risk of maintaining systems

that have outlived their effectiveness. The following table provides examples of 

legacy systems across the federal government that agencies report are 30 years 

or older and use obsolete software or hardware, and identifies those that do not 

have specific plans with time frames to modernize or replace these investments.

Examples of Legacy Investments and Systems 

Agency

Investment 

or system Description

Agencyreported ageSpecific, defined plans for 

modernization or replacement

Department of

the Treasury

Individual 

Master File

The authoritative data source for individual taxpayers 

where accounts are updated, taxes are assessed, 

and refunds are generated. This investment is written 

in assembly language code—a low-level computer 

code that is difficult to write and maintain—and 

operates on an IBM mainframe.

~56 No - The agency has general 

plans to replace this investment, 

but there is no firm date 

associated with the transition.

Department of

the Treasury

Business 

Master File

Retains all tax data pertaining to individual business 

income taxpayers and reflects a continuously updated 

and current record of each taxpayer’s account. This 

investment is also written in assembly language code 

and operates on an IBM mainframe.

~56 No - The agency has general 

plans to update this system, but

there is no time frame 

established for this transition.

Department of 

Defense

Strategic 

Automated 

Command 

and Control 

System

Coordinates the operational functions of the United 

States’ nuclear forces, such as intercontinental 

ballistic missiles, nuclear bombers, and tanker 

support aircrafts. This system runs on an IBM 

Series/1 Computer—a 1970s computing system—

and uses 8-inch floppy disks.

53 Yes - The agency plans to 

update its data storage solutions, 

port expansion processors, 

portable terminals, and desktop 

terminals by the end of fiscal 

year 2017.

Department of 

Veterans 

Affairs 

Personnel 

and 

Accounting 

Integrated 

Data

Automates time and attendance for employees, 

timekeepers, payroll, and supervisors. It is written in 

Common Business Oriented Language (COBOL)—a 

programming language developed in the 1950s and 

1960s—and runs on IBM mainframes. 

53 Yes - The agency plans to 

replace it with a project called 

Human Resources Information 

System Shared Service Center 

in 2017.

Department of 

Veterans 

Affairs 

Benefits 

Delivery 

Network

Tracks claims filed by veterans for benefits, eligibility, 

and dates of death. This system is a suite of COBOL

mainframe applications.

51 No - The agency has general 

plans to roll capabilities into 

another system, but there is no 

firm time frame associated with 

this transition.

Department of 

Justice

Sentry Provides information regarding security and custody 

levels, inmate program and work assignments, and 

other pertinent information about the inmate 

population. The system uses COBOL and Java 

programming languages.

35 Yes - The agency plans to 

update the system through 

September 2016. 

Social 

Security 

Administration

Title II 

Systems

Determines retirement benefits eligibility and 

amounts. The investment is comprised of 162 

subsystems written in COBOL.

31 Yes - The agency has ongoing 

modernization efforts, including 

one that is experiencing cost and 

schedule challenges due to the 

complexities of the legacy 

software. 

Source: GAO analysis of IT Dashboard data, agency documentation, and interviews. | GAO-16-468

Note: Age was reported by agencies. Systems and investments may have individual components 

newer than the reported age. 
Page i GAO-16-468 Legacy Systems

Letter 1

Background 3

Government-wide Spending on IT Operations and Maintenance Is 

Increasing 11

Many O&M Investments Were at Risk and Lacked Proper 

Oversight 20

IT Investments Are Becoming Obsolete and Agencies Are Not 

Required to Identify Investments That Need Attention 26

Conclusions 34

Recommendations for Executive Action 35

Agency Comments and Our Evaluation 35

Appendix I Objectives, Scope and Methodology 39

Appendix II Agency-Reported Spending on O&M 42

Appendix III Bureaus Reporting Spending Less than 10 Percent on Development, 

Modernization, and Enhancement 44

Appendix IV Agency-Reported Oldest Systems or Investments 46

Appendix V Profiles of 12 Legacy Investments or Systems 48

Appendix VI Comments from Department of Commerce 63

Appendix VII Comments from the Department of Defense 65

Appendix VIII Comments from the Department of Energy 67

Contents
Page ii GAO-16-468 Legacy Systems

Appendix IX Comments from the Department of Health and Human Services 69

Appendix X Comments from the Department of Homeland Security 71

Appendix XI Comments from the Department of State 73

Appendix XII Comments from the Department of Veterans Affairs 75

Appendix XIII Comments from the Social Security Administration 77

Appendix XIV GAO Contact and Staff Acknowledgments 79

Tables

Table 1: Ten Largest Expenditures on Operations and 

Maintenance Investments in Fiscal Year 2015, in millions 12

Table 2: Change in Agency Spending on Operations and 

Maintenance from Fiscal Year 2010 to 2015 15

Table 3: Federal Agencies Reporting Less than 10 Percent of 

Their IT Spending on Development, Modernization, and 

Enhancement (DME) in Fiscal Year 2015 17

Table 4: Moderate to High-Risk Operations and Maintenance 

Investments 21

Table 5: At-Risk Investments and Required Analyses and 

Oversight Activities 23

Table 6: Ten Oldest IT Investments or Systems as Reported by 12 

Selected Agencies 28

Table 7: Summary of Investments and Systems Profiled in 

Appendix V 31

Table 8: Agency Spending on Operations and Maintenance 

(O&M) (in millions) and Percentage of IT Spending on 

O&M for Fiscal Years 2010 and 2015 42
Page iii GAO-16-468 Legacy Systems

Table 9: Federal Bureaus Which Reported Spending Less than 10 

Percent of their IT Funds on Development, Modernization, 

and Enhancement (DME) in Fiscal Years 2015 44

Table 10: Agency-Reported Oldest Investments or Systems 46

Figures

Figure 1: Planned Funding of IT Investments for Fiscal Year 2016, 

in billions 5

Figure 2: Fiscal Year 2015 Federal Spending on IT Operations 

and Maintenance and Development, Modernization, and 

Enhancement 11

Figure 3: Summary of IT Spending by Fiscal Year from 2010 

through 2017 (Dollars in Billions) 13

Figure 4: Percentage of IT Spending on Operations and 

Maintenance from Fiscal Year 2010 to Fiscal Year 2017 14

Figure 5: Allocation of Planned IT Spending for Fiscal Year 2015, 

by agency 19

Figure 6: Example of an 8-Inch Floppy Disk 27

Figure 7: National Weather Service Telecommunication Gateway 

Server 56

Figure 8: Department of Defense Air Force Strategic Automated 

Command and Control System 61
Page iv GAO-16-468 Legacy Systems

Abbreviations

CADE 2 Customer Account Data Engine 2

CAS Core Accounting System

CIO Chief Information Officer

COBOL Common Business Oriented Language

Commerce Department of Commerce

DHS Department of Homeland Security

DME development, modernization, and enhancement

DNDO Domestic Nuclear Detection Office

Defense Department of Defense

DOT Department of Transportation

DVIS Diversity Visa Information System

Energy Department of Energy

HHS Department of Health and Human Services

IMF Individual Master File

IRS Internal Revenue Service

IT information technology 

Justice Department of Justice

NWSTG National Weather Service Telecommunication Gateway 

O&M operations and maintenance

OMB Office of Management and Budget

PAID Personnel and Accounting Integrated Data

ROSS Resource Ordering and Status System

SSA Social Security Administration 

State Department of State

Treasury Department of the Treasury

TSA Transportation Security Administration

USCG U.S. Coast Guard

USDA U.S. Department of Agriculture 

VA Department of Veterans Affairs

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-16-468 Legacy Systems

441 G St. N.W.

Washington, DC 20548

May 25, 2016

The Honorable Ron Johnson

Chairman 

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Jason Chaffetz

Chairman

Committee on Oversight and Government Reform

House of Representatives

The federal government spends more than $80 billion annually on 

information technology (IT), with about 75 percent reportedly spent on 

operating and maintaining existing (legacy) IT systems. Given the size 

and magnitude of these investments, it is important that agencies 

effectively manage the operations and maintenance (O&M) of existing 

investments.

Our objectives were to (1) assess federal agencies’ IT O&M spending, (2) 

evaluate the oversight of at-risk legacy investments, and (3) assess the 

age and obsolescence of federal IT.

Our review of O&M spending included the Office of Management and 

Budget (OMB) and the 26 agencies that report to OMB’s IT Dashboard.1

For specific information on individual systems or investments, we focused 

on the 12 agencies that reported the highest planned IT spending for 

 1

In June 2009, OMB established the IT Dashboard, a public website that provides detailed 

information on major IT investments at 26 federal agencies. The 26 agencies are the 

Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human 

Services, Homeland Security, Housing and Urban Development, the Interior, Justice, 

Labor, State, Transportation, the Treasury, and Veterans Affairs; U.S. Army Corps of 

Engineers, Environmental Protection Agency, General Services Administration, National 

Aeronautics and Space Administration, National Archives and Records Administration, 

National Science Foundation, Nuclear Regulatory Commission, Office of Personnel 

Management, Small Business Administration, Social Security Administration, and U.S. 

Agency for International Development.

Letter
Page 2 GAO-16-468 Legacy Systems

fiscal year 2015, given that these agencies make up over 90 percent of 

reported federal IT spending.2

To assess federal agencies’ IT O&M spending, we reviewed data 

reported to OMB as part of the budget process for fiscal years 2010 

through 2017. We analyzed that data to determine whether spending had 

changed over those years and compared OMB’s associated performance 

measure to federal best practices.3

We evaluated the extent to which the 12 selected federal agencies are 

performing oversight on their existing legacy investments by reviewing 

agency IT Dashboard data to identify investments in O&M that had been 

identified as being moderate to high risk. We also reviewed agency 

documentation such as TechStat documentation and operational 

analyses, as available.

To assess the age and obsolescence of federal IT, we reviewed agency 

documentation, such as operational analyses and enterprise architecture 

documents, and interviewed agency officials on issues related to legacy 

investments. We also requested that the 12 agencies provide a list of 

their three oldest systems. In some cases, agencies reported that they do 

not track the ages of individual systems. In those cases, we requested 

that the agency provide their three oldest IT investments. We also 

compared OMB and agencies’ current practices with federal guidance, 

such as OMB’s Circular No. A-11: Preparation, Submission, and 

Execution of the Budget and its associated supplement on capital assets, 

to determine whether OMB and agencies are adequately managing the 

age and obsolescence of federal IT. In addition, we profiled selected 

systems and investments. To select those, we selected a system or 

investment that was identified as one of the agency’s oldest or had been 

identified as being at-risk. In particular, we selected one system or 

investment per agency using factors such as investment type (major or 

 2

These agencies are the Departments of Agriculture, Commerce, Defense, Energy, Health 

and Human Services, Homeland Security, Justice, State, Transportation, the Treasury, 

Veterans Affairs, and the Social Security Administration.

3

Department of the Navy, Office of the Chief Information Officer, Guide for Developing and 

Using Information Technology (IT) Performance Measurements (Washington, D.C.: 

October 2001); and General Services Administration, Office of Governmentwide Policy, 

Performance-Based Management: Eight Steps To Develop and Use Information 

Technology Performance Measures Effectively (Washington, D.C.: 1996).
Page 3 GAO-16-468 Legacy Systems

non-major), system or investment age, and risk level. We reviewed 

agency documentation and interviewed agency officials on the profiled 

systems or investments.

To assess the reliability of the OMB budget data and IT Dashboard data, 

we reviewed related documentation, such as OMB guidance on budget 

preparation, capital planning, and IT Dashboard submissions. In addition, 

we corroborated with each agency that the data downloaded were 

accurate and reflected the data it had reported to OMB. We determined 

that the data were reliable for the purposes of our reporting objectives. 

Details of our objectives, scope, and methodology are contained in 

appendix I.

We conducted this performance audit from April 2015 to May 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Over the last three decades, Congress has enacted several laws to assist 

agencies and the federal government in managing IT investments. For 

example, to assist agencies in managing their investments, Congress 

enacted the Clinger-Cohen Act of 1996.4 This act requires OMB to 

establish processes to analyze, track, and evaluate the risks and results 

of major capital investments in information systems made by federal 

agencies and report to Congress on the net program performance 

benefits achieved as a result of these investments. Most recently, in 

December 2014, Congress enacted IT acquisition reform legislation 

(commonly referred to as the Federal Information Technology Acquisition 

Reform Act or FITARA)5 that, among other things, requires OMB to 

develop standardized performance metrics, including cost savings, and to 

submit quarterly reports to Congress on cost savings.

 4

40 U.S.C. § 11101, et. seq. 

5

Pub. L. No. 113-291, div. A, title VIII, subtitle D ,128 Stat. 3292, 3438-50 (Dec. 19, 2014). 

Background
Page 4 GAO-16-468 Legacy Systems

In carrying out its responsibilities, OMB uses several data collection 

mechanisms to oversee federal IT spending during the annual budget 

formulation process. Specifically, OMB requires federal departments and 

agencies to provide information related to their Major IT Business Cases 

(previously known as exhibit 300) and IT Portfolio Summary (previously 

known as exhibit 53).6

• Major IT Business Case. The purpose of this requirement is to 

provide a business case for each major IT investment and to allow 

OMB to monitor IT investments once they are funded. Agencies are 

required to provide information on each major7 investment’s cost, 

schedule, and performance.

• IT Portfolio Summary. The purpose of the IT portfolio summary is to 

identify all IT investments—both major and non-major —and their 

associated costs within a federal organization. This information is 

designed, in part, to help OMB better understand what agencies are 

spending on IT investments.

OMB directs agencies to break down IT investment costs into two 

categories: (1) O&M and (2) development, modernization, and 

enhancement (DME). O&M (also known as steady state) costs refer to 

the expenses required to operate and maintain an IT asset in a 

production environment. DME costs refers to those projects and activities 

that lead to new IT assets/systems, or change or modify existing IT 

assets to substantively improve capability or performance.

Beginning in 2014, OMB directed agencies to further break down their 

O&M and DME costs to identify provisioned IT service costs. A 

provisioned IT service is one that is (1) owned, operated, and provided by 

an outside vendor or external government organization and (2) consumed 

by the agency on an as-needed basis. Examples of provisioned IT service 

could include cloud services or shared services from another federal 

 6

OMB Circular No. A-11, Preparation, Submission, and Execution of the Budget (June 30, 

2015).

7

According to OMB guidance, a major IT investment requires special management 

attention because of its importance to the mission or function to the government; 

significant program or policy implications; high executive visibility; high development, 

operating, or maintenance costs; unusual funding mechanism; or definition as major by 

the agency’s capital planning and investment control process.
Page 5 GAO-16-468 Legacy Systems

agency or a private service provider. About 8.5 percent of federal 

agencies’ planned spending for fiscal year 2016 has gone toward 

provisioned IT services, leaving the vast majority of spending going 

toward IT that is non-provisioned. Figure 1 shows the breakdown in 

planned spending for fiscal year 2016.

Figure 1: Planned Funding of IT Investments for Fiscal Year 2016, in billions

Further, OMB has developed guidance that calls for agencies to develop 

an operational analysis policy for examining the ongoing performance of 

existing legacy IT investments to measure, among other things, whether 

the investment is continuing to meet business and customer needs.8 This 

guidance calls for the policy to provide for an annual operational analysis 

of each investment that addresses cost, schedule, customer satisfaction, 

strategic and business results, financial goals, and innovation.

Nevertheless, federal IT investments have too frequently failed or 

incurred cost overruns and schedule slippages while contributing little to 

 8

OMB, Preparation, Submission, and Execution of the Budget, Circular No. A-11 (June 30, 

2015); OMB Memorandum M-10-27 (June 2010), requires agencies to establish a policy 

for performing operational analyses on steady state investments as a part of managing 

and monitoring investment baselines. Parts of this guidance do not apply to the 

Department of Defense.
Page 6 GAO-16-468 Legacy Systems

mission-related outcomes. The federal government has spent billions of 

dollars on failed and poorly performing IT investments which often 

suffered from ineffective management, such as project planning, 

requirements definition, and program oversight and governance.9

Accordingly, in February 2015, we introduced a new government-wide 

high-risk area, Improving the Management of IT Acquisitions and 

Operations.

10 This area highlights several critical IT initiatives underway, 

including reviews of troubled projects, an emphasis on incremental 

development, a key transparency website, data center consolidation, and 

the O&M of legacy systems.

To make progress in this area, we identified actions that OMB and the 

agencies need to take. These include implementing the recently-enacted 

statutory requirements promoting IT acquisition reform, as well as 

implementing our previous recommendations. In the last 6 years, we 

made approximately 800 recommendations to OMB and multiple 

agencies to improve effective and efficient investment in IT. As of October 

2015, about 32 percent of these recommendations had been 

implemented.

OMB has implemented a series of initiatives to improve the oversight of 

underperforming investments and more effectively manage IT. These 

efforts include the following:

• IT Dashboard. In June 2009, to further improve the transparency into 

and oversight of agencies’ IT investments, OMB publicly deployed the 

IT Dashboard. As part of this effort, OMB issued guidance directing 

federal agencies to report, via the Dashboard, the performance of 

their IT investments. Currently, the Dashboard publicly displays 

information on the cost, schedule, and performance of over 700 major 

federal IT investments at 26 federal agencies. Further, the public 

display of these data is intended to allow OMB, other oversight 

bodies, and the general public to hold the government agencies 

 9

GAO, Information Technology: OMB and Agencies Need to More Effectively Implement 

Major Initiatives to Save Billions of Dollars, GAO-13-796T (Washington, D.C.: July 25, 

2013).

10GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

OMB’s Recent Major 

Initiatives for Overseeing 

IT Investments
Page 7 GAO-16-468 Legacy Systems

accountable for results and progress. Among other things, agencies 

are to submit ratings from their Chief Information Officers (CIO), 

which, according to OMB’s instructions, should reflect the level of risk 

facing an investment relative to that investment’s ability to accomplish 

its goals. To do so, each agency CIO is to assess his or her IT 

investments against a set of six pre-established evaluation factors 

identified by OMB and then assign a rating of 1 (high risk and red) to 5 

(low risk and green) based on the CIO’s best judgement of the level of 

risk facing the investment. Over the past several years, we have 

made over 20 recommendations to help improve the accuracy and 

reliability of the information on the IT Dashboard and to increase its 

availability.11 Most agencies agreed with our recommendations or had 

no comment.

• TechStat reviews. In January 2010, the Federal CIO began leading 

TechStat sessions—face-to-face meetings to terminate or turn around 

IT investments that are failing or are not producing results. These 

meetings involve OMB and agency leadership and are intended to 

increase accountability and improve performance. OMB also 

empowered agency CIOs to begin to hold their own TechStat 

sessions within their respective agencies by June 2012. In June 2013, 

we reported that OMB and selected agencies held multiple TechStats, 

but additional OMB oversight was needed to ensure that these 

meetings were having the appropriate impact on underperforming 

projects and that resulting cost savings were valid.12 Among other 

things, we recommended that OMB require agencies to address highrisk investments. OMB generally agreed with this recommendation. 

However, as of October 28, 2015, OMB had only conducted one 

TechStat review in the prior 2 years and OMB had not listed any 

 11GAO, IT Dashboard: Agencies Are Managing Investment Risk, but Related Ratings 

Need to Be More Accurate and Available, GAO-14-64 (Washington, D.C.: Dec. 12, 2013); 

Information Technology Dashboard: Opportunities Exist to Improve Transparency and 

Oversight of Investment Risk at Select Agencies, GAO-13-98 (Washington, D.C.: Oct. 16, 

2012); IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to 

Better Inform Decision Making, GAO-12-210 (Washington, D.C.: Nov. 7, 2011); 

Information Technology: OMB Has Made Improvements to Its Dashboard, but Further 

Work Is Needed by Agencies and OMB to Ensure Data Accuracy, GAO-11-262

(Washington, D.C.: Mar. 15, 2011); and Information Technology: OMB’s Dashboard Has 

Increased Transparency and Oversight, but Improvements Needed, GAO-10-701

(Washington, D.C.: July 16, 2010). 

12GAO, Information Technology: Additional Executive Review Sessions Needed to 

Address Troubled Projects, GAO-13-524 (Washington, D.C: June 13, 2013). 
Page 8 GAO-16-468 Legacy Systems

savings from TechStats in its quarterly reporting to Congress since 

June 2012.

• Cloud computing strategy. In order to accelerate the adoption of 

cloud computing solutions across the government, OMB’s 25-Point IT 

Reform Plan included a “Cloud First” policy that required each agency 

CIO to, among other things, implement cloud-based solutions 

whenever a secure, reliable, and cost-effective cloud option exists.13

Building on this requirement, in February 2011, OMB issued the 

Federal Cloud Computing Strategy, which provided definitions of 

cloud computing services; benefits of cloud services, such as 

accelerating data center consolidations; case studies to support 

agencies’ migration to cloud computing; and roles and responsibilities 

for federal agencies.14 In April 2016, we reported,15 among other 

things, that we had identified 10 key practices that if included in cloud 

service agreements can help agencies ensure services are performed 

effectively, efficiently, and securely. OMB’s guidance, released in 

February 2012, included most of the key practices, and we 

recommended that OMB include all 10 key practices in future 

guidance.

• PortfolioStat reviews. To better manage existing IT systems, OMB 

launched the PortfolioStat initiative in March 2012, which requires

agencies to conduct an annual, agency-wide IT portfolio review to, 

among other things, reduce commodity IT16 spending and 

demonstrate how their IT investments align with the agency’s mission 

and business functions. In 2013 and 2015 we reported17 that agencies 

 13OMB, 25-Point Implementation Plan to Reform Federal Information Technology 

Management (Washington, D.C.: Dec. 9, 2010).

14OMB, Federal Cloud Computing Strategy (Washington, D.C.: Feb. 8, 2011).

15GAO, Cloud Computing: Agencies Need to Incorporate Key Practices to Ensure 

Effective Performance, GAO-16-325 (Washington, D.C.: Apr. 7, 2016).

16According to OMB, commodity IT includes services such as IT infrastructure (data 

centers, networks, desktop computers and mobile devices); enterprise IT systems (e-mail, 

collaboration tools, identity and access management, security, and web infrastructure); 

and business systems (finance, human resources, and other administrative functions). 

17GAO, Information Technology: Additional OMB and Agency Actions Are Needed to 

Achieve Portfolio Savings, GAO-14-65 (Washington, D.C.: Nov. 6, 2013); and Information 

Technology: Additional OMB and Agency Actions Needed to Ensure Portfolio Savings Are 

Realized and Effectively Tracked, GAO-15-296 (Washington, D.C.: Apr. 16, 2015).
Page 9 GAO-16-468 Legacy Systems

had the potential to save at least $3.8 billion through this initiative. 

However, we noted that weaknesses existed in agencies’

implementation of the initiative; therefore, we made more than 60 

recommendations to OMB and agencies. OMB partially agreed with 

our recommendations, and responses from 21 of the agencies varied, 

with some agreeing and others not.

• IT Shared Services Strategy. In May 2012, OMB released its 

Federal IT Shared Services Strategy.18 The strategy requires 

agencies to use shared services—IT functions that are provided for 

consumption by multiple organizations within or between federal 

agencies—for IT service delivery in order to increase return on 

investment, eliminate waste and duplication, and improve the 

effectiveness of IT solutions. Examples of commodity IT areas to 

consider migrating to a shared environment, as described in the 

strategy, include software licenses, e-mail systems, and human 

resource systems.

We have previously reported on legacy IT and the need for the federal 

government to improve its oversight of such investments. For example, in 

October 2012,19 we reported on agencies’ operational analyses policies 

and practices. As previously mentioned, operational analysis is a key 

performance evaluation and oversight mechanism required by OMB to 

ensure O&M investments continue to meet agency needs. In particular, 

we reported that although OMB guidance called for agencies to develop 

an operational analysis policy and perform such analyses annually, the 

extent to which the selected five federal agencies we reviewed carried out 

these tasks varied significantly. Specifically, the Departments of 

Homeland Security (DHS) and Health and Human Services (HHS) 

developed policies and conducted analyses, but excluded key 

investments and assessment factors. The Departments of Defense 

(Defense), the Treasury (Treasury), and Veterans Affairs (VA) had not 

developed a policy or conducted operational analyses. As such, we 

recommended that the agencies develop operational analysis policies, 

 18OMB, Federal Information Technology Shared Services Strategy (Washington, D.C.: 

May 2, 2012).

19GAO, Information Technology: Agencies Need to Strengthen Oversight of Billions of 

Dollars in Operations and Maintenance Investments, GAO-13-87 (Washington, D.C.: Oct. 

16, 2012).

GAO Has Reported on the 

Need to Improve 

Oversight of Legacy IT
Page 10 GAO-16-468 Legacy Systems

annually perform operational analyses on all investments, and ensure the 

assessments include all key factors. Further, we recommended that OMB 

revise its guidance to include directing agencies to post the results of 

such analyses on the IT Dashboard. OMB and the five selected agencies 

agreed with our recommendations and have efforts planned and 

underway to address them. In particular, OMB issued guidance in August 

2012 directing agencies to report operational analysis results along with 

their fiscal year 2014 budget submission documentation (e.g., exhibit 300) 

to OMB. Thus far, operational analyses have not yet been posted on the 

IT Dashboard.

We further reported in November 2013 that agencies were not conducting 

proper analyses. Specifically, we reported20 on IT O&M investments and 

the use of operational analyses at selected agencies and determined that 

of the top 10 investments with the largest spending in O&M, only the DHS 

investment underwent an operational analysis. DHS’s analysis addressed 

most, but not all, of the factors that OMB called for (e.g., comparing 

current cost and schedule against original estimates). DHS officials 

attributed this to the department still being in the process of implementing 

its new operational analysis policy. The remaining agencies did not 

assess their investments, which accounted for $7.4 billion in reported 

O&M spending. Agency officials cited several reasons for not doing so, 

including relying on budget submission and related management reviews 

that measure performance; however, OMB has noted that these are not a 

substitute for an operational analysis. Consequently, we recommended 

that seven agencies perform operational analyses on their IT O&M 

investments and that DHS ensure that its analysis was complete and 

addressed all OMB factors. Three of the agencies agreed with our 

recommendations; two partially agreed; and two agencies had no 

comments.

 20GAO, Information Technology: Agencies Need to Strengthen Oversight of Multibillion 

Dollar Investments in Operations and Maintenance, GAO-14-66 (Washington, D.C.: Nov. 

6, 2013).
Page 11 GAO-16-468 Legacy Systems

Federal agencies reported spending the majority of their fiscal year 2015 

IT funds on operating and maintaining a large number of legacy (i.e., 

steady-state) investments. Of the more than $80 billion reportedly spent 

on federal IT in fiscal year 2015, 26 federal agencies21 spent about $61 

billion on O&M, more than three-quarters of the total amount spent. 

Specifically, data from the IT Dashboard shows that, in 2015, 5,233 of the 

government’s nearly 7,000 investments were spending all of their funds 

on O&M activities. This is a little more than three times the amount spent 

on DME activities (See figure 2).

Figure 2: Fiscal Year 2015 Federal Spending on IT Operations and Maintenance and 

Development, Modernization, and Enhancement

According to agency data reported to OMB’s IT Dashboard, the 10 IT 

investments spending the most on O&M for fiscal year 2015 total $12.5 

billion, 20 percent of the total O&M spending, and range from $4.4 billion 

on the Department of Health and Human Services’ (HHS) Centers for 

Medicare and Medicaid Services’ Medicaid Management Information 

 21This $80 billion represents what 26 agencies reported to OMB on planned IT spending. 

However, this $80 billion figure is understated. This figure does not include spending for 

Defense classified IT systems; and 58 independent executive branch agencies, including 

the Central Intelligence Agency. Additionally, not all executive branch IT investments are 

included in this estimate because agencies have differed on what they considered an IT

investment. For example, some have considered research and development systems as 

IT investments, while others have not.

Government-wide 

Spending on IT 

Operations and 

Maintenance Is 

Increasing
Page 12 GAO-16-468 Legacy Systems

System22 to $666.1 million on HHS’s Centers for Medicare and Medicaid 

Services IT Infrastructure investment (see table 1).

Table 1: Ten Largest Expenditures on Operations and Maintenance Investments in 

Fiscal Year 2015, in millions

Agency Investment

Fiscal year 2015 

funds in millions

Department of 

Health and Human 

Services

Centers for Medicare and Medicaid Services’

Medicare Management Information Systema

$4,381.0

Department of 

Defense

Defense Information Systems Network

$1,252.2

Department of 

Veterans Affairs

Medical IT Support

$1,234.9

Department of 

Defense

Next Generation Enterprise Network 

Increment 1 $1,057.7

Social Security 

Administration

Infrastructure Operations and Maintenance

$864.0

Department of 

Veterans Affairs

Enterprise IT Support

$809.5

Department of 

Defense

Network Enterprise Technology Command

$767.5

Department of 

Defense

Network Enterprise Center Staff Operations 

Costs $752.8

Department of 

Defense

Non-Defense Information Systems Network 

Telecomm $688.8

Department of 

Health and Human 

Services

Centers for Medicare and Medicaid Services 

IT Infrastructure – Ongoing

$666.1

Total $12,474.5 million

Source: GAO analysis of agency budgetary data. | GAO-16-468

Note: aThis investment represents the federal share of state Medicaid systems’ cost. In technical 

comments on a draft of this report, the Department of Health and Human Services stated that it does 

not manage any of these IT assets or control how this money is spent.

 22The 50 states, the District of Columbia, and the 5 U.S. territories each administer a 

state-based Medicaid program. Every state must implement a claims processing and 

information retrieval system to support the administration of the program. This investment 

represents the federal share of state Medicaid systems’ cost. In technical comments on a 

draft of this report, HHS stated that it does not manage any of these IT assets or control 

how this money is spent.
Page 13 GAO-16-468 Legacy Systems

Over the past 7 fiscal years, O&M spending has increased, while the 

amount invested in developing new systems has decreased by about 

$7.3 billion since fiscal year 2010. (See figure 3.)

Figure 3: Summary of IT Spending by Fiscal Year from 2010 through 2017 (Dollars in Billions)

Note: According to DOD officials, the department’s fiscal year 2010 IT expenditures reported to the IT 

Dashboard includes both classified and unclassified spending, whereas its fiscal year 2011 to 2017 

expenditures only include unclassified spending.

Further, agencies have increased the amount of O&M spending relative 

to their overall IT spending by 9 percent since 2010. Specifically, in fiscal 

year 2010, O&M spending was 68 percent of the federal IT budget, while 

in fiscal year 2017, agencies plan to spend 77 percent of their IT funds on 

O&M. (See figure 4.)

Spending on O&M Has 

Increased over 7 Years
Page 14 GAO-16-468 Legacy Systems

Figure 4: Percentage of IT Spending on Operations and Maintenance from Fiscal 

Year 2010 to Fiscal Year 2017

Further, 15 of the 26 agencies have increased their spending on O&M 

from fiscal year 2010 to fiscal year 2015, with 10 of these agencies 

having over a $100 million increase. The spending changes per agency 

range from an approximately $4 billion increase (HHS) to a decrease of 

$600 million (National Aeronautics and Space Administration). See table 

2 for more details on agency spending.
Page 15 GAO-16-468 Legacy Systems

Table 2: Change in Agency Spending on Operations and Maintenance from Fiscal 

Year 2010 to 2015

Agency

Change in spending,

in millions (percent change)

Department of Health and Human Services $4,288.7 (-10.5%)

Department of Veterans Affairs $792.8 (2.5%)

Department of Homeland Security $632.8 (16.6%)

Department of Agriculture $582.0 (6.6%)

Department of Transportation $361.3 (6.8%)

Social Security Administration $292.0 (9.4%)

Department of Justice $258.9 (14.6%)

Department of the Treasury $211.4 (-8.1%)

Department of the Interior $116.8 (5.0%)

Department of State $109.0 (-0.9%)

Department of Labor $80.9 (2.2%)

Department of Education $61.3 (19.5%)

Nuclear Regulatory Commission $27.0 (5.6%)

National Science Foundation $15.0 (1.0%)

Office of Personnel Management $10.5 (-16.3%)

Small Business Administration $-3.2 (11.1%)

National Archives and Records Administration $-4.7 (9.3%)

U.S. Agency for International Development $-8.6 (19.1%)

General Services Administration $-19.7 (-5.9%)

Environmental Protection Agency $-28.4 (7.0%)

U.S. Army Corps of Engineers $-38.4 (3.5%)

Department of Housing and Urban Development $-50.7 (-1.5%)

Department of Commerce $-112.6 (17.0%)

Department of Energy $-303.5 (1.8%)

Department of Defense $-450.3 (13.9%)

National Aeronautics and Space Administration $-600.2 (1.2%)

Source: GAO analysis of IT Dashboard data. | GAO-16-468

In addition, 20 of the 26 agencies have increased the percentage of total 

IT spending on O&M from fiscal year 2010 to fiscal year 2015, with 13 

agencies having an increase of over 5 percent. The percentage of total IT 

spending on O&M ranges from a 20 percent increase (Department of 

Education) to a 16 percent decrease (Office of Personnel Management). 

Appendix II provides detailed information on agency spending on 

operations and maintenance from fiscal year 2010 to fiscal year 2015.
Page 16 GAO-16-468 Legacy Systems

According to agency officials, reasons for the increase in O&M spending 

include the recent shift of major systems from DME to O&M (as the 

investment completed development activities and began O&M activities); 

and rising costs to maintain legacy IT infrastructure, such as those that 

use older programming languages. They also noted that improved 

reporting (i.e., ensuring that O&M expenditures were properly reported as 

O&M instead of as DME) has made it appear that O&M spending has 

increased.

For example, a DHS official in the Office of the CIO stated that one 

reason for the increased spending on O&M as a percentage of its total is 

because initially DHS had high DME spending to setup the agency, but 

now that the major parts of the agency are established, the funding has 

shifted to O&M.23 DHS officials stated that they anticipate future increases 

in DME funding as prioritized IT modernization efforts are approved and 

funded. Further, an official in Department of State’s (State) Bureau of 

Information Resource Management stated that the increase is largely due 

to increased costs of maintaining the infrastructure, including meeting 

security requirements. Moreover, VA officials stated that updates to its 

technology are the primary reason for the increase in spending. In 

addition, an official in HHS’s Office of the CIO stated that the increased 

spending on O&M was largely due to grants to states and local entities for 

new programs, such as the Affordable Care Act.

Conversely, several agencies have decreased spending on O&M. For 

example, as we have previously reported, the Department of Energy 

(Energy) reduced spending by approximately $300 million, which it 

attributed to the reclassification of high performance computers from the 

IT portfolio to facilities.24 According to Energy officials, these investments 

were re-categorized because they include both supercomputers and 

laboratory facilities.25 Similarly, the Department of Commerce 

(Commerce) reduced spending by approximately $110 million and 

attributed it to the reclassification of satellite ground systems from its IT 

portfolio. In making this decision, Commerce determined that it needed to 

 23DHS was established in 2002 and combined 22 different departments and agencies into 

one cabinet-level agency.

24GAO-14-64.

25While Energy has reportedly established a separate process to report to OMB on these 

computers, these expenditures are not included in federal estimates of IT O&M spending.
Page 17 GAO-16-468 Legacy Systems

refocus oversight efforts to a more appropriate level and consequently 

minimized the role of the CIO and others in the oversight of satellites. We 

disagreed with these reclassifications, and reported that they run contrary 

to the Clinger-Cohen Act of 1996, which specifies requirements for the 

management of IT. Further, we reported that by gathering incomplete 

information on IT investments, OMB increases the risk of not fulfilling its 

oversight responsibilities, of agencies making inefficient and ineffective 

investment decisions, and of Congress and the public being misinformed 

as to the performance of federal IT investments. We recommended that 

Energy and Commerce appropriately categorize their IT investments, but 

both agencies disagreed.

A policy analyst within OMB’s Office of E-Government and Information 

Technology expressed concern when agencies, or their bureaus, spend a 

low percentage of their IT funds on DME. The analyst further stated that 

this could indicate that the agency’s maintenance costs are reducing its 

flexibility and the agency or bureau is unable to innovate. For example, 5 

of the 26 agencies that report to the IT Dashboard reported spending less 

than 10 percent on DME activities in fiscal year 2015 (see table 3).

Table 3: Federal Agencies Reporting Less than 10 Percent of Their IT Spending on 

Development, Modernization, and Enhancement (DME) in Fiscal Year 2015

Agency

Percent spent

on DME activities

Department of Housing and Urban Development 7.55%

Department of the Interior 8.17%

Environmental Protection Agency 9.92%

National Aeronautics and Space Administration 8.70%

U.S. Army Corps of Engineers 0.75%

Source: GAO analysis of IT Dashboard data. | GAO-16-468

Further, 34 percent of bureaus (i.e., 51 of the 151) spent less than 10 

percent on DME. For more details on the bureaus spending less than 10 

percent on DME activities, see appendix III.

According to agency officials, reasons for these bureaus’ low spending on 

DME include the size and mission of the bureau (e.g., smaller bureaus do 

not perform much DME work), as well as several bureaus having recently 

completed major DME work that is now in the O&M phase. Further, 

according to Commerce officials, one of their bureaus had no actual IT 

systems in its budget, as its IT has been absorbed by headquarters, and 

thus any DME spending is part of the Office of IT Services’ budget.
Page 18 GAO-16-468 Legacy Systems

OMB staff in the Office of E-Government and Information Technology 

have recognized the upward trend of O&M spending and identified 

several contributing factors, including (1) the support of O&M activities 

requires maintaining legacy hardware, which costs more over time, and 

(2) costs are increased in maintaining applications and systems that use 

older programming languages, since programmers knowledgeable in 

these older languages are becoming increasingly rare and thus more 

expensive. Further, OMB officials stated that in several situations where 

agencies are not sure whether to report costs as O&M or DME, agencies 

default to reporting as O&M. According to OMB, agencies tend to 

categorize investments as O&M because they attract less oversight, 

require reduced documentation, and have a lower risk of losing funding.

OMB encourages agencies to adopt provisioned IT services, such as 

cloud computing and shared services, to make IT more efficient and agile, 

and enable innovation.26 Specifically, it provides an approach for

agencies to implement cloud-based solutions whenever a secure, 

reliable, and cost-effective cloud option exists and to use shared services 

for IT service delivery in order to increase return on investment, eliminate 

waste and duplication, and improve the effectiveness of IT solutions. 

Further, as part of its guidance on the implementation of recent IT 

legislation,27 OMB identified a series of performance metrics for agencies’

PortfolioStat sessions to measure the federal government’s progress in 

driving value in federal IT investments. One measure is the percent of IT 

spending on non-provisioned O&M spending. An OMB official stated that 

focusing on the O&M spending that has not been provisioned will allow 

OMB to identify legacy systems in need of modernization.

Federal agencies reported spending $55 billion—69 percent of total IT 

spending—on non-provisioned O&M in fiscal year 2015, with the percent 

allocated to non-provisioned O&M varying by agency. For example, State 

allocates about 87 percent of its IT spending on non-provisioned O&M, 

whereas the Department of Transportation (DOT) allocates 50 percent. 

See figure 5 for details on agencies’ planned spending allocations.

 26OMB, Federal Cloud Computing Strategy, (Washington, D.C.: Feb. 8, 2011).

27OMB, Management and Oversight of Federal Information Technology, M-15-14 

(Washington, D.C.: June 10, 2015).

Less than a Quarter of 

Federal IT Spending Is 

Categorized as 

Provisioned
Page 19 GAO-16-468 Legacy Systems

Figure 5: Allocation of Planned IT Spending for Fiscal Year 2015, by agency

Additionally, OMB has not identified an associated goal with its nonprovisioned IT measure that is part of PortfolioStat process. An OMB 

official within the Office of E-Government and Information Technology 

stated that the aim is for the amount of spending on DME and provisioned 

IT services to rise, thus reducing the percent of spending on nonprovisioned IT. This official also stated that OMB has not identified a 

specific goal for the measure because it would be ever changing. While 

goals for performance measures may change over time, it is still 
Page 20 GAO-16-468 Legacy Systems

important for OMB to set a target by which agencies can measure their 

progress in meeting this measure.

In particular, leading practices stress that organizations should measure 

performance in order to evaluate the success or failure of their activities 

and programs.28 Performance measurement involves identifying 

performance goals and measures, identifying targets for improving 

performance, and measuring progress against those targets. Without 

links to outcomes and goals, organizations are not able to effectively 

measure progress toward those goals. Further, OMB’s own website, 

performance.gov29 states that when measuring performance, a goal is a 

simple but powerful way to motivate people and communicate priorities. 

In addition, the website states that the federal government operates more 

effectively when agency leaders, at all levels of the organization, starting 

at the top, set clear measurable goals aligned to achieving better 

outcomes.

Until OMB develops a specific goal associated with measuring nonprovisioned services, OMB and agencies will be limited in their ability to 

evaluate progress that has been made and whether or not they are 

achieving their goals to increase the amount spent on development 

activities and provisioned IT services.

According to OMB guidance,30 the O&M phase is often the longest phase 

of an investment and can consume more than 80 percent of the total 

lifecycle costs. As such, agencies must actively manage their investment 

during this phase. To help them do so, OMB requires that CIOs submit 

ratings that reflect the level of risk facing an investment.

 28Department of the Navy, Office of the Chief Information Officer, Guide for Developing 

and Using Information Technology (IT) Performance Measurements (Washington, D.C.: 

October 2001); and General Services Administration, Office of Governmentwide Policy, 

Performance-Based Management: Eight Steps To Develop and Use Information 

Technology Performance Measures Effectively (Washington, D.C.: 1996).

29In 2011, OMB established a single, performance-related website 

(http://performance.gov) that is intended to provide both a public view into government 

performance to support transparency as well as providing executive branch management 

capabilities to enhance senior leadership decision making. 

30OMB, Preparation, Submission, and Execution of the Budget, Circular No. A-11 (2015).

Many O&M 

Investments Were at 

Risk and Lacked 

Proper Oversight
Page 21 GAO-16-468 Legacy Systems

Several O&M investments were rated as moderate to high risk in fiscal 

year 2015. Specifically, CIOs from the 12 selected agencies reported that 

23 of their 187 major IT O&M investments were moderate to high risk as 

of August 2015. They requested $922.9 million in fiscal year 2016 for 

these investments. Of the 23 investments, agencies had plans to replace 

or modernize 19 investments. However, the plans for 12 of those were 

general or tentative in that the agencies did not provide specificity on time 

frames, activities to be performed, or functions to be replaced or 

enhanced. Further, agencies did not plan to modernize or replace 4 of the 

investments (see table 4).

Table 4: Moderate to High-Risk Operations and Maintenance Investments 

Agency Investment title (IT portfolio)

CIO rating, as 

of August 2015

Specific, defined plans for modernization or 

replacement

Department of 

Agriculture

Resource Ordering and Status Systema Moderate Yes - Agency plans to replace the system in 2018.

Public Safety Land Mobile Radio System Moderate No - Agency recently began a modernization 

initiative; however, it is not clear when it will be 

completed.

Forest Service Computer Base Moderate No - Agency has general plans to restructure the 

investment to allow better visibility into the underlying 

systems, but has not provided plans for functions to 

be replaced or enhanced.

Enterprise Telecommunications Shared 

Services

High Yes - Agency has several modernization efforts 

underway, including one to consolidate networks.

Department of 

Commerce

National Oceanic and Atmospheric 

Administration/ National Weather Service 

Telecommunication Gateway Systema

High Yes - Agency plans to retire the system in fiscal year 

2017, and replace it with a new system.

Office of Chief Information Officer 

Enterprise Cyber Security Monitoring and 

Operations

Moderate No - Agency has general plans to update cyber 

monitoring across the agency, but has not provided 

specific activities or timelines associated with this 

effort.

Department of 

Energy

Contractor Business Financial and 

Administrative Systemsa Moderate No - Agency has no firm future plans for retirement or modernization.

Department of 

Health and 

Human Services

Centers for Medicare and Medicaid 

Services Medicare Appeals Systema Moderate No - The agency has general plans for continuous modernization, as funding allows; but has not 

provided specific activities or timelines associated 

with this effort. 

Trusted Internet Connection Investment Highb No - Agency has general plans to continually 

evaluate the investment and perform necessary 

improvements as needed; but has not provided plans 

for specific functions to be replaced or enhanced.

Department of 

Homeland 

Security

Immigration and Customs Enforcement -

Detention and Removal Operations 

Modernization 

Moderate Yes - Agency has specific plans to improve the core 

database infrastructure in fiscal year 2016.
Page 22 GAO-16-468 Legacy Systems

Agency Investment title (IT portfolio)

CIO rating, as 

of August 2015

Specific, defined plans for modernization or 

replacement

Immigration and Customs Enforcement - IT 

Infrastructure

Moderate Yes - Agency plans to replace its IT equipment that 

is outdated in 2016.

National Protection and Programs 

Directorate - Infrastructure Security 

Compliance - Chemical Security 

Assessment Tool

Moderate No - Agency has general plans for minor 

enhancements, but has not provided specific 

timelines associated with this effort.

OneNet Moderate No - Agency has general plans for continuous 

updates to this investment as user requirements 

change, but has not provided specific timelines 

associated with this effort.

Coast Guard - Vessel Logistics System Moderate No - Agency has plans to decommission one system 

within the investment in 2016. The agency has 

general plans to replace the full investment in the 

future with the Logistics Information Management 

System, but there is no firm transition date.

Coast Guard - Core Accounting System 

Suitea Moderate Yes - Agency plans to retire the system in fiscal year 2018 with a migration to federal shared services.

Coast Guard - Standard Workstation 

Infrastructure Recapitalization and 

Sustainment

Moderate No - Agency has general plans, including a migration 

to Windows 10, but did not provide dates on when 

this would happen.

Customs and Border Protection - Tactical 

Communications Modernization

Moderate Yes - Agency plans to decommission obsolete 

equipment by the end of fiscal year 2017.

Customs and Border Protection -

Integrated Fixed Towers 

Highb No - Agency has no plans for retirement or 

modernization at this time because the investment 

only reached initial operating capability in October 

2015. It plans to reach final operating capability in 

fiscal year 2020.

National Protection and Programs 

Directorate – Federal Protective Service 

Tac Com Equipment and Support

Moderate No - Agency has general plans to update the 

program, but no firm date associated with the effort.

Customs and Border Protection - Tethered 

Aerostat Radar System 

Moderate No - Agency has no plans for replacement or 

modernization of the investment, but is currently 

undergoing an analysis of alternatives to determine 

whether they should modernize or replace the 

system. 

Customs and Border Protection – TRIRIGA Moderate No - Agency has no plans for replacement or 

modernization of the investment.

Department of 

the Treasury

Departmental Offices IT Infrastructure 

Mainframes and Servers Services and 

Support

Moderate No - Agency has general plans to update this 

investment, but has not provided specific activities or 

timelines associated with this effort. 

Departmental Offices IT Infrastructure End 

User Systems and Support 

Moderate No - Agency has general plans to update this 

investment, but has not provided specific activities or 

timelines associated with this effort.

Source: GAO analysis of IT Dashboard data, agency documentation, and interviews. | GAO-16-468

Notes:

a

Investment was selected for profiling and will be discussed further in an appendix of the report.
Page 23 GAO-16-468 Legacy Systems

b

According to agency officials, this investment has since been lowered to moderate risk.

The lack of specific plans to modernize or replace these investments 

could result in wasteful spending on moderate- and high-risk investments.

In instances where investments experience problems, agencies can 

perform a TechStat, a face-to-face meeting to terminate or turn around IT 

investments that are failing or not producing results.31 In addition, OMB 

directs agencies to monitor O&M investments through operational 

analyses, which should be performed annually and assess costs, 

schedules, whether the investment is still meeting customer and business 

needs, and investment performance.

While agencies generally conducted the required operational analyses, 

they did not consistently perform TechStat reviews on all of the at-risk 

investments. Table 5 provides details on the 23 investments and whether 

the operational analyses and TechStats were performed.

Table 5: At-Risk Investments and Required Analyses and Oversight Activities

Agency Investment

TechStat 

performed

Operational 

analysis 

performed

Department of 

Agriculture

Resource Ordering and Status System X X

Public Safety Land Mobile Radio System X

Forest Service Computer Base X

Enterprise Telecommunications Shared Services X

Department of 

Commerce

National Oceanic and Atmospheric Administration/ National Weather Service 

Telecommunication Gateway System

X X

Office of Chief Information Officer Enterprise Cyber Security Monitoring and 

Operations

Department of 

Energy

Contractor Business Financial and Administrative Systems X X

Department of 

Health and 

Human Services

Centers for Medicare and Medicaid Services Medicare Appeals System X X

Trusted Internet Connection Investment X

 31OMB, 25-Point Implementation Plan to Reform Federal Information Technology 

Management (Washington, D.C.: Dec. 9, 2010). 

Many O&M Investments 

Lacked Reviews and 

Oversight
Page 24 GAO-16-468 Legacy Systems

Agency Investment

TechStat 

performed

Operational 

analysis 

performed

Department of 

Homeland 

Security

Immigration and Customs Enforcement - Detention and Removal Operations 

Modernization

X

Immigration and Customs Enforcement - IT Infrastructure X

National Protection and Programs Directorate - Infrastructure Security Compliance -

Chemical Security Assessment Tool

X

OneNet X

Coast Guard - Vessel Logistics System X

Coast Guard - Core Accounting System Suite X

Coast Guard - Standard Workstation Infrastructure Recapitalization and 

Sustainment

X

Customs and Border Protection - Tactical Communications Modernization X

Customs and Border Protection - Integrated Fixed Towers

National Protection and Programs Directorate – Federal Protective Service Tac 

Com Equipment and Support

X X

Customs and Border Protection - Tethered Aerostat Radar System X

Customs and Border Protection – TRIRIGA X

Department of the 

Treasury

Departmental Offices IT Infrastructure Mainframes and Servers Services and 

Support

Departmental Offices IT Infrastructure End User Systems and Support

Source: GAO analysis of agency documentation. | GAO-16-468

Although not required, agencies had performed TechStats on only five of 

the at-risk investments. Moreover, TechStats were not performed on 

three of the four investments rated as high risk:

• DHS’s Customs and Border Protection - Integrated Fixed Towers,

• HHS’s Trusted Internet Connection Investment, and

• U.S. Department of Agriculture’s (USDA) Enterprise 

Telecommunications Shared Services.

Agencies provided several reasons for not conducting TechStats. For 

example, according to agency officials, several of the investments’ risk 

levels were reduced to low or moderately-low risk in the months since the 

IT Dashboard had been publicly updated.32 An Acting Deputy Executive 

Director in DHS’s Enterprise Business Management Office stated that the 

 32The public portion of the IT Dashboard is not updated during the formulation of 

President’s Budget.
Page 25 GAO-16-468 Legacy Systems

agency had performed an internal “health assessment” on its Integrated 

Fixed Towers investment, understood the issues it was facing, and 

decided that a TechStat was not necessary. An official from HHS’s Office 

of the CIO stated that, at the time it was evaluated, its Trusted Internet 

Connection Investment did not meet its internal TechStat criteria of 

having cost variance over 10 percent. An official from USDA’s Office of 

the CIO stated that while the office did not hold a formal TechStat, the 

program was required to work on a corrective action plan and has since 

been upgraded from high to moderate risk.

It should be noted that recent legislation requires agencies to perform a 

review of each major IT investment that receives a high-risk rating for 4 

consecutive quarters.33 Further, the associated OMB guidance requires 

agencies to hold a TechStat on an investment if it has been rated as high 

risk for 3 consecutive months.34

In addition, operational analyses were not conducted for four at-risk 

investments. These investments were:

• Commerce’s Enterprise Cyber Security Monitoring and Operations,

• DHS’s Integrated Fixed Towers,

• Treasury’s Departmental Offices IT Infrastructure Mainframes and 

Servers Services and Support, and

• Treasury’s Departmental Offices IT Infrastructure End User Systems 

and Support.

An official from Commerce’s Office of the CIO stated that, in place of 

operational analyses, National Weather Service (the responsible bureau) 

reviews the status of the previous month’s activities for the development, 

integration, modification, and procurement to report issues to 

management. However, Commerce’s monthly process does not include 

all of the key elements of an operational analysis. The Integrated Fixed 

Towers Program Manager stated that since the investment had only 

 3340 U.S.C. § 11302(c)(4). The statute does not specify that a TechStat must be 

conducted but requires a review that shall identify the (1) root causes of the high risk, (2) 

extent to which the causes can be addressed, and (3) probability of future success. The 

assessment of Defense’s major IT investments may be accomplished in accordance with 

10 U.S.C. § 2445c.

34OMB, Management and Oversight of Federal Information Technology, Memorandum M15-14 (Washington, D.C.: June 10, 2015).
Page 26 GAO-16-468 Legacy Systems

become operational in October 2015, an operational analysis was not yet 

required. DHS plans to perform the analysis on the investment in August 

2017. Performing the analysis once the investment is operational will 

enable DHS to determine whether it is meeting the needs of the agency 

and delivering the expected value.

The Director of Treasury’s Capital Planning and Investment Control 

program stated that the department’s policy does not require 

infrastructure investments to have an operational analysis performed.35

However, OMB’s guidance on operational analyses does not exclude 

infrastructure investments.

Until agencies ensure that their O&M investments are fully reviewed, the 

government’s oversight of old and vulnerable investments will be impaired 

and the associated spending could be wasteful.

Legacy IT investments across the federal government are becoming 

increasingly obsolete. Specifically, many use outdated languages and old 

parts. Numerous old investments are using obsolete programming 

languages. Several agencies, such as the Department of Justice 

(Justice), DHS, HHS, Treasury, USDA, and VA, reported using Common 

Business Oriented Language (COBOL)—a programming language 

developed in the late 1950s and early 1960s—to program their legacy 

systems. It is widely known that agencies need to move to more modern, 

maintainable languages, as appropriate and feasible. For example, the 

Gartner Group, a leading IT research and advisory company, has 

reported that organizations using COBOL should consider replacing the 

language and in 2010 noted that there should be a shift in focus to using 

more modern languages for new products.36

In addition, some legacy systems may use parts that are obsolete and 

more difficult to find. For instance, Defense is still using 8-inch floppy 

 35As of 2015, Treasury’s bureau, the Internal Revenue Service, developed and 

implemented a process to prioritize its operations support activities that addresses 

prioritization and comparison of IT assets against each other and criteria for making 

selection and prioritization decisions.

36Gartner, IT Market Clock for Application Development, August 2010.

IT Investments Are 

Becoming Obsolete 

and Agencies Are Not 

Required to Identify 

Investments That 

Need Attention
Page 27 GAO-16-468 Legacy Systems

disks in a legacy system that coordinates the operational functions of the 

United States’ nuclear forces.37 (See figure 6).

Figure 6: Example of an 8-Inch Floppy Disk

Further, in some cases, the vendors no longer provide support for 

hardware or software, creating security vulnerabilities and additional 

costs. For example, each of the 12 selected agencies reported using 

unsupported operating systems and components in their fiscal year 2014 

reports pursuant to the Federal Information Security Management Act of 

2002. Commerce, Defense, DOT, HHS, and VA reported using 1980s 

and 1990s Microsoft operating systems that stopped being supported by 

the vendor more than a decade ago.

 37Introduced in the 1970s, the 8-inch floppy disk is a disk-based storage medium that 

holds 80 kilobytes of data. In comparison, a single modern flash drive can contain data 

from the equivalent of more than 3.2 million floppy disks.
Page 28 GAO-16-468 Legacy Systems

Lastly, legacy systems may become increasingly more expensive as 

agencies have to deal with the previously mentioned issues and may pay 

a premium to hire staff or contractors with the knowledge to maintain 

outdated systems. For example, one agency (SSA) reported re-hiring 

retired employees to maintain its COBOL systems.

Selected agencies reported that they continue to maintain old 

investments in O&M. For example, Treasury reported systems that were 

about 56 years old.

Table 6 shows the 10 oldest investments and/or systems, as reported by 

selected agencies.38 Agencies reported having plans to modernize or 

replace each of these investments and systems. However, the plans for 

five of those were general or tentative in that the agencies did not provide 

specific time frames, activities to be performed, or functions to be 

replaced or enhanced. For a full list of the agencies’ reported oldest 

systems, see appendix IV.

Table 6: Ten Oldest IT Investments or Systems as Reported by 12 Selected Agencies

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

the Treasury

Individual Master 

File

This investment is the authoritative data source 

for individual taxpayer accounts where accounts 

are updated, taxes are assessed, and refunds 

are generated during the tax filing period. It is 

written in assembly language code—a low-level 

computer code that is difficult to write and 

maintain. However, the hardware has been 

upgraded to a more modern IBM mainframe.

~56 No - A new investment will 

eventually replace this 

investment, but there is no firm 

date associated with the 

transition.

Department of 

the Treasury

Business Master 

File

This investment retains all tax data pertaining to 

individual business income taxpayers and 

reflects a continuously updated and current 

record of each taxpayer’s account. It is also 

written in assembly language code and 

operates on an IBM mainframe. 

~56 No - The agency has general 

plans to update this system, but 

there is no date associated with 

this update.

 38Not all agencies track systems and their associated ages in the same manner—some 

track individual systems and others track by investment. An investment may be made up 

of several systems and infrastructure. In some cases, agencies were unsure of the actual 

age of the system or investment and had to approximate the initiation date.
Page 29 GAO-16-468 Legacy Systems

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

Defense

Strategic 

Automated 

Command and 

Control System

This system coordinates the operational 

functions of the United States’ nuclear forces, 

such as intercontinental ballistic missiles, 

nuclear bombers, and tanker support aircrafts. It 

runs on an IBM Series/1 Computer—a 1970s 

computing system—and uses 8-inch floppy 

disks.

53 Yes - The agency is planning to 

update data storage solutions, 

port expansion processors, 

portable terminals, and desktop 

terminals; which are all 

scheduled to be completed by 

the end of fiscal year 2017.

Department of 

Veterans 

Affairs

Personnel and 

Accounting 

Integrated Data

This system automates time and attendance for 

employees, timekeepers, payroll, and 

supervisors. It is written in COBOL—a 

programming language developed in the 1950s 

and 1960s—and runs on IBM mainframes.

53 Yes - The agency plans to 

replace it with a project called 

Human Resources Information 

System Shared Service Center 

in 2017.

Department of 

Defense

Compass This system is a command and control system 

that is used for deliberate and crisis action 

planning, strategic mobility analysis, and 

mobilization and deployment movement 

execution. It runs on a Windows 2008 server 

and is programed in Java—a programming 

language first released in 1995. It also uses a 

2009 Oracle 11g database.

52 Yes - The system is currently 

using an Oracle 11g database, 

but the agency plans to migrate it

to a 2012 SQL server by the end 

of the year.

Department of 

Veterans 

Affairs

Benefits Delivery 

Network

This system tracks claims filed by veterans for 

benefits, eligibility, and dates of death. It is a 

suite of COBOL mainframe applications.

51 No - The agency has general 

plans to roll capabilities into 

another system, but there is no 

firm date associated with this 

transition.

Department of 

Transportation

Hazardous 

Materials 

Information 

System at the 

Pipeline and 

Hazardous 

Materials Safety 

Administration

This system allows the agency to maintain 

comprehensive information on hazardous 

materials incidents. The software applications 

and processes used by the system, such as 

Classic Active Server Pages and 

Microsoft.NET, have become outdated and 

costly to maintain. In addition, the system uses 

an application that is no longer supported by the 

manufacturer, which can cause security risks, 

among other issues.

~46 Yes - All legacy components 

within this system are scheduled 

to be replaced by 2018.

Department of 

Commerce

National Oceanic 

and Atmospheric 

Administration/ 

National Weather 

Service 

Dissemination 

Systems

This investment includes three information 

dissemination systems used to provide the US 

public and emergency managers warnings of 

severe weather events. It runs a variety of 

operating systems and software, including 

Windows Server 2003, which is no longer 

supported by the vendor, and uses a variety of 

programming languages including FORTRAN—

a high-level programming language developed 

in the 1950s for scientific and engineering 

applications.

46 No - The agency has general 

plans to continuously update 

system components.
Page 30 GAO-16-468 Legacy Systems

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

Commerce

National Oceanic 

and Atmospheric 

Administration/ 

National Weather 

Service/ National 

Data Buoy Center 

Ocean Observing 

System of 

Systems

This investment supports systems that include 

meteorological, oceanographic, tsunami, and 

climate observing platforms. It runs on both 

Windows and Linux operating systems, 

including Windows Server 2003, which is no 

longer supported by the vendor. In addition, it 

uses a version of Oracle that is also no longer 

fully supported by the vendor. This investment 

also uses a variety of programming languages, 

including FORTRAN.

46 No - The agency has general 

plans for continuous incremental 

upgrades to this investment. 

Department of 

Homeland 

Security

Immigration and 

Customs 

Enforcement -

Hiring Tracking 

Systems

This system is used by the agency to track 

current and prior hiring actions and maintains 

information about individuals who are selected 

for vacant positions. It runs on a 2008 IBM z10 

mainframe using COBOL, among other 

languages. The web component runs on a 

Windows 2012 server using Java.

39 Yes - The agency plans to 

replace the existing mainframe 

with a service-oriented 

architecture to allow for 

integration with new systems 

beginning in fiscal year 2016, 

contingent upon receiving 

funding. 

Source: GAO analysis of agency data. | GAO-16-468

Note: Systems and investments may have selected components newer than the reported age.

Separately, we profiled one system or investment from each of the 12 

selected agencies. The selected systems and investments range from 11 

to approximately 56 years old, and serve a variety of purposes. For 

example, Treasury’s Individual Master File was first initiated about 56 

years ago and currently is the authoritative data source for individual 

taxpayer accounts where accounts are updated, taxes are assessed, and 

refunds are generated during the tax filing period. In addition, DOT’s 

profiled system was initiated about 46 years ago and allows the agency to 

maintain comprehensive information on hazardous materials incidents. Of 

the 12 investments or systems, agencies had plans to replace or 

modernize 11 of these. However, the plans for 3 of those were general or 

tentative in that the agencies did not provide specificity on time frames, 

activities to be performed, or functions to be replaced or enhanced. 

Further, there were no plans to replace or modernize 1 investment. The 

profiles of these systems and investments are summarized in table 7 and 

can be found in appendix V.
Page 31 GAO-16-468 Legacy Systems

Table 7: Summary of Investments and Systems Profiled in Appendix V

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

Commerce

National Weather 

Service 

Telecommunication 

Gateway

This investment is the nation’s hub for the 

collection and distribution of weather data and 

products. The agency replaced its hardware 

and software with Power7 IBM servers and 

Unix operating systems; however, the 

investment still lacks full backup capability for 

26 percent of its functions.

31 Yes - The agency plans to retire 

the system in fiscal year 2017 and 

replace it with a new system.

Department of 

Defense

Strategic 

Automated 

Command and 

Control System

This system coordinates the operational 

functions of the nation’s nuclear forces. This 

system is running on an IBM Series/1 

Computer—a 1970s computing system—and 

uses 8-inch floppy disks.

53 Yes - The agency is planning to 

update data storage solutions, 

port expansion processors, 

portable terminals, and desktop 

terminals are scheduled for 

completion by the end of fiscal 

year 2017. A full system 

replacement is scheduled to be 

completed in fiscal year 2020.

Department of 

Homeland 

Security

Core Accounting 

System Suite

This investment is the primary financial 

management system for the Coast Guard and 

other Department of Homeland Security 

agencies. The system relies on outdated and 

heavily customized Oracle Federal Financials 

software that was first available in 2004, and 

the extended vendor support for the software 

ended in November 2013. As a result, it has 

become expensive to support. Further, it relies 

on Windows 2003 servers and any changes 

would require recoding of many functions within 

its suite. In some cases, Coast Guard is unable 

to upgrade the system to the newest version of 

software because it is dependent on older 

versions of supporting software.

18 Yes - The agency plans to 

transition to federal shared 

services in fiscal year 2018.

Department of 

Transportation

Hazardous Material 

Information System

This system maintains and provides access to 

comprehensive information on hazardous 

materials incidents, among other things. The 

software applications and processes used by 

the system, such as Classic Active Server 

Pages and Microsoft.NET, have become 

outdated and costly to maintain. In addition, the 

system uses an application that is no longer 

supported by the manufacturer, which can 

cause security risks, among other issues.

~46 Yes - The agency is developing a 

new system to replace legacy 

modules and plans to retire the 

legacy modules by the end of 

fiscal year 2018. 
Page 32 GAO-16-468 Legacy Systems

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

Energy

Contractor 

Business Financial 

and Administrative 

Systems

This investment is the business and 

administrative systems for a management and 

operating contractor, liquid waste contractor, 

and the site security contractor to manage 

human resources, financial reporting, supply 

chain, and project management. It runs on 

Windows and Unix servers and uses Oracle’s 

PeopleSoft applications. The investment has 

gone through several updates, with the last 

including the retirement of 16 associated legacy 

applications in 2011.

12 No - The agency does not have 

future plans for retirement or 

modernization. 

Department of 

Health and 

Human 

Services

Medicare Appeals 

System

This system facilitates the maintenance and 

transfer of case-specific data with regard to 

Medicare appeals through multiple levels of the 

appeal process. The system runs on a Solaris 

10 operating system and uses commercial-offthe-shelf systems for case management and 

reporting.

11 No - The agency has general 

plans to continuously update the 

system. 

Department of 

Justice

Sentry This system provides information regarding 

security and custody levels, inmate program 

and work assignments, and other pertinent 

information about the inmate population. When 

the system was first deployed, it was comprised 

of approximately 700 program routines written 

in COBOL and ran on a mainframe platform. 

Over the years, the agency has updated the 

system to allow for web accessibility.

35 Yes – The agency plans to update 

the user interface and integrate 

system data through September 

2016. 

Social Security 

Administration

Title II Systems These systems determine retirement benefits 

eligibility and amounts. The investment is 

comprised of 162 subsystems, and some are 

still written in COBOL.

31 Yes - The agency has ongoing 

modernization efforts, including 

one that is experiencing cost and 

schedule challenges due to the 

complexities of the legacy 

software.

Department of 

State

Diversity Visa 

Information System

This system is an electronic case management 

system to track and validate application 

information submitted by foreign nationals 

under the Diversity Visa immigration program. 

The interface software, PowerBuilder, is no 

longer supported by the vendor.

~26 No - The agency plans to replace 

the investment at an unknown 

date and has general plans to 

upgrade unsupported software to 

a new version, which is also not 

supported.

Department of 

the Treasury

Individual Master 

File

This investment is the authoritative data source 

for individual taxpayer accounts where 

accounts are updated, taxes are assessed, and 

refunds are generated during the tax filing 

period. This investment is written in assembly 

language code—a low-level computer code that 

is difficult to write and maintain—and operates 

on an IBM mainframe.

~56 No - The agency plans to replace 

the investment at an unknown 

date.
Page 33 GAO-16-468 Legacy Systems

Agency

Investment

or system Description

Agencyreported 

age

Specific, defined plans for 

modernization or replacement

Department of 

Agriculture

Resource Ordering 

and Status System

This investment mobilizes and deploys a 

multitude of resources, including qualified 

individuals, teams, aircraft, equipment, and 

supplies to fight wildland fires and respond to all 

hazard incidents. One of the applications the 

system uses is no longer supported by the 

vendor, creating vulnerability issues.

18 Yes - The agency plans to replace 

the system in 2018.

Department of 

Veterans 

Affairs

Personnel and 

Accounting 

Integrated Data

This system automates time and attendance for 

employees, timekeepers, payroll, and 

supervisors. This system is written in COBOL—

a programming language developed in the 

1950s and 1960s—and runs on IBM 

mainframes.

53 Yes - The agency plans to replace 

most of the system’s functionality 

in 2017. 

Source: GAO analysis of agency documentation and interviews. | GAO-16-468

Note: Systems and investments may have components newer than the reported age.

We have previously provided guidance that organizations should 

periodically identify, evaluate, and prioritize their investments, including 

those that are in O&M; at, near, or exceeding their planned life cycles; 

and/or are based on technology that is now obsolete, to determine 

whether the investment should be kept as-is, modernized, replaced or 

retired.39 This critical process allows the agency to identify and address 

high-cost or low-value investments in need of update, replacement, or 

retirement.

Agencies are, in part, maintaining obsolete investments because they are 

not required to identify, evaluate, and prioritize their O&M investments to 

determine whether they should be kept as-is, modernized, replaced, or 

retired. According to OMB staff from the Office of E-Government and 

Information Technology, OMB has created draft guidance that will require 

agencies to identify and prioritize legacy information systems that are in 

need of replacement or modernization. Specifically, the guidance is 

intended to develop criteria through which agencies can identify the 

highest priority legacy systems, evaluate and prioritize their portfolio of 

existing IT systems, and develop modernization plans that will guide 

agencies’ efforts to streamline and improve their IT systems.

 39GAO, Information Technology Investment Management: A Framework for Assessing 

and Improving Process Maturity, Version 1.1, GAO-04-394G (Washington, D.C.: March 

2004). 
Page 34 GAO-16-468 Legacy Systems

The draft guidance includes time frames for the efforts regarding 

developing criteria, identifying and prioritizing systems, and planning for 

modernization. However, OMB did not commit to a firm time frame for 

when the policy would be issued. Until OMB’s policy is finalized and 

carried out, the federal government runs the risk of continuing to maintain 

investments that have outlived their effectiveness and are consuming 

resources that outweigh their benefits.

Regarding upgrading obsolete investments, in April 2016, the IT 

Modernization Act40 was introduced into the U.S. House of 

Representatives. If enacted, it would establish a revolving fund of $3 

billion that could be used to retire, replace, or upgrade legacy IT systems 

to transition to new, more secure, efficient, modern IT systems. It also 

would establish processes to evaluate proposals for modernization 

submitted by agencies and monitor progress and performance in 

executing approved projects. 

Of the more than $80 billion that the 26 agencies reported spending for 

federal IT in fiscal year 2015, the agencies spent about $61 billion on 

O&M. This O&M spending has steadily increased and as a result, key 

agencies are devoting a small amount of IT spending to DME activities. 

To its credit, OMB has identified a performance metric to measure the 

percent of IT spending on non-provisioned IT spending. However, it has 

not identified an associated goal with this measure. Until it does so, OMB 

and agencies will be constrained in their ability to evaluate their progress 

in adopting cloud and shared services.

Several of the 12 selected agencies’ major O&M investments were rated 

as moderate or high risk in fiscal year 2015. While the agencies had 

specific plans to retire or modernize some of these investments, most 

investments did not have specific plans with time frames, activities to be 

performed, or functions to be replaced or enhanced. Further, agencies did 

not consistently perform required analysis on at-risk investments. Until 

agencies fully review at-risk O&M investments, the government’s 

oversight of such investments will be impaired and its spending could be 

wasteful.

 40Information Technology Modernization Act, H.R. 4897, 114th Cong. (2016).

Conclusions
Page 35 GAO-16-468 Legacy Systems

Finally, legacy federal IT investments are becoming obsolete. Several 

aging investments are using unsupported components, many of which did 

not have specific plans for modernization or replacement. This is contrary 

to OMB’s draft initiative, which calls for agencies to analyze and review 

O&M investments. Until this policy is finalized and implemented, the 

federal government runs the risk of continuing to maintain investments 

that have outlived their effectiveness and are consuming resources that 

outweigh their benefits.

To better manage legacy systems and investments, we are making 2 

recommendations to OMB and 14 recommendations to federal agencies.

Specifically, we recommend that the Director of OMB

• identify and publish a specific goal associated with its non-provisioned 

O&M spending measure, and

• commit to a firm date by which its draft guidance on legacy systems 

will be issued, and subsequently direct agencies to identify legacy 

systems and/or investments needing to be modernized or replaced.

To monitor whether existing investments are meeting the needs of their 

agencies, we recommend that the Secretaries of Commerce and the 

Treasury direct the respective agency CIO to ensure that required 

analyses are performed on investments in the operations and 

maintenance phase.

Further, to address obsolete IT investments in need of modernization or 

replacement, we recommend that the Secretaries of Agriculture, 

Commerce, Defense, Energy, Health and Human Services, Homeland 

Security, State, the Treasury, Transportation, and Veterans Affairs; the 

Attorney General; and the Commissioner of Social Security direct their 

respective agency CIOs to identify and plan to modernize or replace 

legacy systems as needed and consistent with OMB’s draft guidance, 

including time frames, activities to be performed, and functions to be 

replaced or enhanced.

We received comments on a draft of this report from OMB and the other 

12 agencies in our review. Eight agencies (USDA, Commerce, HHS, 

DHS, State, Transportation, VA, and SSA) and OMB agreed with our 

recommendations, Defense and Energy partially agreed, and Justice and 

Recommendations for 

Executive Action

Agency Comments 

and Our Evaluation
Page 36 GAO-16-468 Legacy Systems

the Treasury stated they had no comment on the recommendations. Each 

agency’s comments are discussed in more detail below.

• In comments provided via e-mail on May 12, 2016, an official from 

OMB’s Office of E-Government and Technology stated that it 

concurred with our recommendations. The agency also provided 

technical comments, which we have incorporated in the report as 

appropriate.

• In comments provided via e-mail on May 3, 2016, an official from 

USDA’s Office of the CIO’s Oversight and Compliance Division stated 

that the department concurred with our recommendation.

• In written comments, Commerce concurred with both of its 

recommendations. Regarding the recommendation that the 

department ensure that required analyses are performed on 

investments in the O&M phase, the department concurred and stated 

that it will reiterate and expand the department’s existing policies 

requiring such analyses. The department also concurred with the 

recommendation to identify and plan to modernize or replace legacy 

systems and stated that it is already appropriately replacing and 

modernizing systems as needed within budget constraints. 

Commerce’s comments are reprinted in appendix VI. The department 

also provided technical comments, which we have incorporated in the 

report as appropriate.

• In written comments, Defense partially concurred with our 

recommendation to address obsolete IT investments in need of 

modernization or replacement. It stated that the department has 

modernized, upgraded, or retired hundreds of systems in the last 

several years through an investment review process. The department 

stated it plans to continue to identify, prioritize, and manage legacy 

systems that should be modernized or replaced, based on existing 

department policies and processes, and consistent to the extent 

practicable with OMB’s draft guidance. Defense’s plan to be 

consistent with OMB’s guidance to the extent practicable is consistent 

with the intent of our recommendation. Defense’s comments are 

reprinted in appendix VII.

• In written comments, Energy partially concurred with our 

recommendation to address obsolete IT investments and stated that 

the department continues to take steps to modernize its legacy 

investments and systems, as needed and as funding is available. It 

further stated that all four of the systems listed in appendix IV have 
Page 37 GAO-16-468 Legacy Systems

been identified for modernization or replacement and three have been 

modernized as recently as fiscal year 2015. However, since OMB’s 

draft guidance has not yet been issued, Energy could not concur with 

this part of the recommendation, but plans to review and consider 

implementation of such guidance. Energy’s plan to consider OMB’s 

guidance when it is finalized is consistent with the intent of our 

recommendation. Energy’s comments are reprinted in appendix VIII. 

The department also provided technical comments, which we have 

incorporated in the report as appropriate.

• In written comments, HHS stated that it concurred with our 

recommendation and is working to identify and plan to modernize or 

replace IT systems. HHS’s comments are reprinted in appendix IX. 

The department also provided technical comments, which we have 

incorporated in the report as appropriate.

• In written comments, DHS stated that it concurred with its 

recommendation and that the department plans to establish a 

framework for identifying and replacing or modernizing legacy 

systems after receipt of the finalized guidance. DHS’s comments are 

reprinted in appendix X. The department also provided technical 

comments, which we have incorporated in the report as appropriate.

• In comments provided via e-mail on May 11, 2016, an official from 

Justice’s audit liaison group, speaking on behalf of the department, 

stated that it had no comment on the recommendation but plans to 

follow OMB’s guidance once it is formally issued. The department also 

provided technical comments, which we have incorporated in the 

report as appropriate.

• In written comments, State agreed with the recommendation and 

noted that it is currently awaiting final modernization guidance from 

OMB. Upon publication of OMB’s guidance, it plans to work with OMB 

to develop detailed plans for modernization. State’s comments are 

reprinted in appendix XI. The department also provided technical 

comments, which we have incorporated in the report as appropriate.

• In comments provided via e-mail on May 12, 2016, an official from

Treasury’s Office of the CIO stated that the department had no 

comments on the draft report.

• In comments provided via e-mail on May 6, 2016, an official from 

Transportation’s Office of the Secretary stated that the department 
Page 38 GAO-16-468 Legacy Systems

concurred with the draft findings and recommendations and had no 

additional comments on the report.

• In written comments, VA concurred with our recommendation and 

stated that it launched a new office in April 2016 that will provide 

lifecycle management oversight for portfolios of systems. In addition, it 

stated that the department is planning to retire two high-risk, COBOLbased systems (Personnel and Accounting Integrated Data and 

Benefits Delivery Network) in 2017 and 2018, respectively. VA’s 

comments are reprinted in appendix XII.

• In written comments, SSA stated that it agreed with our 

recommendation and that it has already initiated numerous activities 

to modernize or replace legacy systems. SSA’s comments are 

reprinted in appendix XIII.

We are sending copies of this report to interested congressional 

committees; the Secretaries of Agriculture, Commerce, Defense, Energy, 

Health and Human Services, Homeland Security, State, the Treasury, 

Transportation, and Veterans Affairs; the U.S. Attorney General of the 

Department of Justice; the Commissioner of the Social Security 

Administration; the Director of the Office of Management and Budget and 

other interested parties. This report will also be available at no charge on 

our website at http://www.gao.gov.

If you or your staffs have any questions on matters discussed in this 

report, please contact me at (202) 512-9286 or pownerd@gao.gov. 

Contact points for our Offices of Congressional Relations and Public 

Affairs may be found on the last page of this report. GAO staff who made 

major contributions to this report are listed in appendix XIV.

David A. Powner

Director

Information Technology Management Issues
Appendix I: Objectives, Scope and 

Methodology

Page 39 GAO-16-468 Legacy Systems

Our objectives were to (1) assess the extent to which federal agencies 

have invested in operating and maintaining existing information 

technology (IT), (2) evaluate the oversight of at-risk legacy investments, 

and (3) assess the age and obsolescence of federal IT.

For our first objective, our review included the Office of Management and 

Budget (OMB) and the 26 agencies that report to OMB’s IT Dashboard.1

For all three objectives, to identify specific reasons for changes in 

spending and specific information on individual systems or investments, 

we focused on the 12 agencies with the highest planned IT spending for 

fiscal year 2015, given that these agencies make up over 90 percent of 

reported federal IT spending:

• Department of Agriculture,

• Department of Commerce,

• Department of Defense,

• Department of Energy,

• Department of Health and Human Services,

• Department of Homeland Security,

• Department of Justice,

• Department of State,

• Department of the Treasury,

• Department of Transportation,

• Department of Veterans Affairs, and

• Social Security Administration.

To assess the extent to which federal agencies have invested in 

operating and maintaining existing IT, we reviewed data reported to OMB 

as part of the budget process to determine operations and maintenance 

(O&M) spending for fiscal years 2010 through 2017. We analyzed that 

data to determine the extent to which spending had changed over those 

years. We also compared OMB’s associated performance measure on 

 1

The 26 agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services, Homeland Security, Housing and Urban 

Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and 

Veterans Affairs; as well as the U.S. Army Corps of Engineers, Environmental Protection 

Agency, General Services Administration, National Aeronautics and Space Administration, 

National Archives and Records Administration, National Science Foundation, Nuclear 

Regulatory Commission, Office of Personnel Management, Small Business 

Administration, Social Security Administration, and U.S. Agency for International 

Development.

Appendix I: Objectives, Scope and 

Methodology
Appendix I: Objectives, Scope and 

Methodology

Page 40 GAO-16-468 Legacy Systems

driving value in federal IT investments (the percent of IT spending that is 

on development, modernization, and enhancement (DME) activities or 

provisioned O&M services) to federal best practices.2 To assess the 

cause of the changes in spending, we evaluated OMB budget data and 

interviewed officials at the 12 selected agencies and OMB.

To evaluate the oversight of at-risk legacy investments, we reviewed 

agency IT Dashboard data from the 12 selected agencies to identify 

investments in O&M that had been identified as being moderate to high 

risk. Specifically, we reviewed IT Dashboard data on O&M investments to 

identify those that were rated as moderate to high risk by the agency chief 

information officer (CIO). We reviewed agency documentation such as 

TechStat documentation and operational analyses that had been 

performed on the investments, as available. In addition, we interviewed 

agency officials to determine plans for replacing or modernizing the 

investments.

To assess the age and obsolescence of federal IT, we reviewed agency 

documentation associated with their legacy investments, such as 

operational analyses and enterprise architecture documents, and 

interviewed agency officials on the issues related to legacy investments. 

We also requested that agencies provide a list of their three oldest 

systems. In some cases, agencies reported that they do not track the 

ages of individual systems. In those cases, we requested that the 

agencies provide their three oldest IT investments. Agencies noted that 

these systems and investments may have components that are newer 

than their operational age. We also compared OMB and agencies’ current 

practices with federal guidance, such as OMB’s Circular No. A-11: 

Preparation, Submission, and Execution of the Budget and its associated 

supplement on capital assets, to determine whether OMB and agencies 

are adequately managing the age and obsolescence of federal IT. We 

then interviewed agency officials to confirm and obtain additional 

information on the systems or investments.

 2

Department of the Navy, Office of the Chief Information Officer, Guide for Developing and 

Using Information Technology (IT) Performance Measurements (Washington, D.C.: 

October 2001); and General Services Administration, Office of Governmentwide Policy, 

Performance-Based Management: Eight Steps To Develop and Use Information 

Technology Performance Measures Effectively (Washington, D.C.: 1996).
Appendix I: Objectives, Scope and 

Methodology

Page 41 GAO-16-468 Legacy Systems

To select systems or investments to profile, we identified agencies’

existing investments in O&M that were rated as medium or high risk by 

their agencies’ CIO (from the previous objective on oversight). Since not 

all of our selected agencies had identified an at-risk O&M investment (the 

Departments of Defense, Justice, State, Transportation, and Veterans 

Affairs and the Social Security Administration did not), we also used the 

list of agency-identified oldest systems or investments. From the resulting 

list of systems and investments, we selected one system or investment 

per agency using the following factors: investment type (major or nonmajor), system or investment age, and risk level as of November 2015. In 

particular, we sought to have a mix of systems and investments that 

included both major and non-major investment types; a range of ages; 

and a range of risk ratings. We also reviewed agency documentation and 

interviewed agency officials on those profiled systems or investments.

To assess the reliability of the OMB budget data and IT Dashboard data, 

we reviewed related documentation, such as OMB guidance on budget 

preparation, capital planning, and IT Dashboard submissions. In addition, 

we corroborated with each agency that the data downloaded were 

accurate and reflected the data it had reported to OMB. We determined 

that the budget and IT Dashboard data were reliable for our purposes of 

reporting IT O&M spending and related information on O&M investments.

We conducted this performance audit from April 2015 to May 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Appendix II: Agency-Reported Spending on

O&M

Page 42 GAO-16-468 Legacy Systems

Table 8 provides the reported spending by agency on operations and 

maintenance (O&M) and the percentage of IT spending on O&M for fiscal 

years 2010 and 2015.

Table 8: Agency Spending on Operations and Maintenance (O&M) (in millions) and Percentage of IT Spending on O&M for 

Fiscal Years 2010 and 2015

Agency

2010 O&M (% of IT 

spending on O&M)

2015 O&M (% of IT 

spending on O&M)

Change in spending 2010 to 

2015 (% of spending on O&M)

Department of Agriculture $2,137.6 (82.4%) $2,719.7 (89.0%) $582.0 (6.6%)

Department of Commerce 1,525.5 (50.1) 1,413.0 (67.1) -112.6 (17.0)a

Department of Defense 23,940.0 (63.4) 23,490.0 (77.2) -450.3 (13.9)b

Department of Education 473.2 (58.3) 548.8 (77.8) 61.3 (19.5)

Department of Energy 1,691.1 (85.6) 1,387.5 (87.4) -303.5 (1.8)

Department of Health and Human Services 4,905.8 (77.9) 9,194.5 (67.4) 4,288.7 (-10.5)

Department of Homeland Security 4,287.3 (66.6) 4,920.1 (83.2) 632.8 (16.6)

Department of Housing and Urban Development 335.4 (94.0) 284.7 (92.5) -50.7 (-1.5)

Department of the Interior 830.8 (86.8) 947.6 (91.8) 116.8 (5.0)

Department of Justice 1,891.0 (66.6) 2,150.5 (81.2) 258.9 (14.6)

Department of Labor 456.5 (78.3) 537.3 (80.5) 80.9 (2.2)

Department of State 1,269.5 (88.3) 1,378.5 (87.4) 109.0 (-0.9)

Department of Transportation 1,291.9 (43.6) 1,653.2 (50.4) 361.3 (6.8)

Department of the Treasury 2,675.2 (84.7) 2,886.6 (76.6) 211.4 (-8.1)

Department of Veterans Affairs 2,686.6 (80.4) 3,479.3 (82.9) 792.8 (2.5)

Environmental Protection Agency 383.4 (83.1) 355.0 (90.1) -28.4 (7.0)

General Services Administration 485.0 (77.5) 465.3 (71.6) -19.7 (-5.9)

National Aeronautics and Space Administration 1,865.4 (90.1) 1,265.2 (91.3) -600.2 (1.2)

National Archives and Records Administration 69.5 (49.4) 64.8 (58.7) -4.7 (9.3)

National Science Foundation 78.8 (83.1) 93.9 (84.1) 15.0 (1.0)

Nuclear Regulatory Commission 131.6 (83.0) 158.5 (88.7) 27.0 (5.6)

Office of Personnel Management 60.8 (73.9) 71.4 (57.6) 10.5 (-16.3)

Small Business Administration 83.2 (66.9) 80.0 (78.0) -3.2 (11.1)

Social Security Administration 811.0 (49.9) 1,103.0 (59.3) 292.0 (9.4)

U.S. Agency for International Development 111.9 (59.4) 103.3 (78.6) -8.6 (19.1) 

U.S. Army Corps of Engineers 479.1 (95.8) 440.7 (99.3) -38.4 (3.5)

Totals $54,958.0 (68.1) $60,177.9 (76.1) $6,220.0 (8.0) 

Source: GAO analysis of data reported by agencies to the Office of Management and Budget’s IT Dashboard. | GAO-16-468

aAgency officials stated that the increase in O&M spending was due to the reclassification of satellite 

ground systems that are no longer considered an IT investment. As previously reported, we disagree 

Appendix II: Agency-Reported Spending on 

O&M 
Appendix II: Agency-Reported Spending on 

O&M

Page 43 GAO-16-468 Legacy Systems

with these reclassifications and believe that they run contrary to the Clinger-Cohen Act of 1996, which 

specifies requirements for the management of IT.

b

According to Department of Defense officials, the department’s fiscal year 2010 IT expenditures

reported to the IT Dashboard includes both classified and unclassified spending, whereas its fiscal 

year 2011 to 2017 expenditures only include unclassified spending.
Appendix III: Bureaus Reporting Spending 

Less than 10 Percent on Development, 

Modernization, and Enhancement

Page 44 GAO-16-468 Legacy Systems

Table 9 lists the 51 federal bureaus which reported spending less than 10 

percent of their IT funds on development, modernization, and 

enhancement in fiscal year 2015.

Table 9: Federal Bureaus Which Reported Spending Less than 10 Percent of their IT Funds on Development, Modernization, 

and Enhancement (DME) in Fiscal Years 2015

Agency Bureau Percent spent on DME 

Department of Agriculture Agricultural Research Service 9.24%

Executive Operations 0%

Forest Service 0.86%

National Agricultural Statistics Service 6.7%

Office of Chief Financial Officer 0%

Office of Chief Information Officer 4.66%

Office of Inspector General 0%

Office of the General Counsel 0%

Department of Commerce Department of Commercea 8.06%

Economic Development Administration 0%

Economics and Statistics Administration 8.38%

National Institute of Standards and Technology 0%

Department of Energy Departmental Administration 8.78%

Energy Programs 9.50%

Environmental and Other Defense Activities 4.82%

Department of Health and Human Services Administration for Children and Familiesb 4.07%

Agency for Healthcare Research and Quality 8.25%

Indian Health Service 8.30%

Department of Homeland Security Department of Homeland Securitya 9.41%

Federal Emergency Management Agency 5.17%

Federal Law Enforcement Training Center 1.82%

Office of the Inspector General 0%

Transportation Security Administration 5.7%

U.S. Customs and Border Protection 9.43%

Department of Housing and Urban Development Department of Housing and Urban Developmenta 7.59%

Management and Administration 0%

Department of Justice Federal Prison System 4.22%

Office of Justice Programs 8.80%

United States Parole Commission 0%

Appendix III: Bureaus Reporting Spending 

Less than 10 Percent on Development, 

Modernization, and Enhancement
Appendix III: Bureaus Reporting Spending 

Less than 10 Percent on Development, 

Modernization, and Enhancement

Page 45 GAO-16-468 Legacy Systems

Agency Bureau Percent spent on DME 

Department of Labor Bureau of Labor Statistics 7.97%

Employee Benefits Security Administration 0%

Employment and Training Administration 8.95%

Office of Federal Contract Compliance Programs 0%

Office of Labor Management Standards 0%

Office of Workers Compensation Programs 6.16%

Wage and Hour Division 0%

Department of the Interior Bureau of Land Management 9.86%

Department of the Interiora 7.28%

Office of Surface Mining Reclamation and Enforcement 5.09%

Office of the Special Trustee for American Indians 2.82%

United States Geological Survey 0.19%

Department of the Treasury Alcohol and Tobacco Tax and Trade Bureau 0%

Comptroller of the Currency 0%

Financial Crimes Enforcement Network 3.87%

United States Mint 2.64%

Department of Transportation Federal Railroad Administration 6.85%

Maritime Administration 3.01%

Office of Inspector General 0%

Environmental Protection Agency Environmental Protection Agency 9.92%

National Aeronautics and Space Administration National Aeronautics and Space Administrationa 8.7%

U.S. Army Corps of Engineers Corps of Engineers-Civil Works 0.75%

Source: GAO analysis of IT Dashboard data. | GAO-16-468

a

Some agencies have bureaus named the same as the agency, but these are one of several bureaus 

and do not necessarily include all of that particular agency’s investments.

b

According to the Department of Health and Human Services, 89 percent ($593 million) of the 

Administration for Children and Families is allocated to grants to state and local IT investments. Out 

of the remaining funds, the Administration for Children and Families spends 35.6 percent of its IT 

budget on DME activities.
Appendix IV: Agency-Reported Oldest 

Systems or Investments

Page 46 GAO-16-468 Legacy Systems

As part of this review, we requested that agencies provide a list of their 

three oldest systems. In some cases, agencies reported that they do not 

track the ages of individual systems, and as a result, we requested that 

the agency provide their 3 oldest IT investments and their approximate 

age. Table 10 provides a listing these systems or investments, as 

reported by agencies.

Table 10: Agency-Reported Oldest Investments or Systems 

Agency Investment/system

Year 

operational

Approximate 

age 

Department of 

Agriculture

Forest Service Automated Timber Sale Accounting 1980 36

Farm Service Agency Consolidated General Sales Manager #107 1982 34

Forest Service Computer Base 1983 33

Department of 

Commerce

National Weather Service Dissemination Systems 1970 46

National Data Buoy Center Ocean Observing System of Systems 1970 46

National Oceanic and Atmospheric Administration Office of the Chief Information 

Officer Financial Management IT Operations

1978 38

Department of 

Homeland 

Security

Immigration and Customs Enforcement Hiring Tracking Systems 1977 39

Customs and Border Protection Computerized Aircraft Reporting and Material 

Control

1979 37

Federal Emergency Management Agency United States Fire Administration 

Systems

1982 34

Department of 

Defense

Strategic Automated Command and Control System 1963 53

Compass 1964 52

AN/WLR-9B(V) Series 1971 45

Department of 

Energya Office of Environmental Management Savannah River Telecommunications Networks – Telephone System

1989 27

Associate Under Secretary for Environment, Health, Safety and Security 

Enterprise Personnel Security Systems

1990s ~26 

Associate Under Secretary for Environment, Health, Safety and Security 

Enterprise Health and Safety Reporting Systems

1990s ~26 

Associate Under Secretary for Environment, Health, Safety and Security 

Enterprise Security Program Systems

1990s ~26

Department of 

Health and 

Human Services

Centers for Medicare and Medicaid Services Medicare Beneficiary Enrollment 

Data Management

1984 32

Indian Health Service Resource and Patient Management System - Maintenance 

and Enhancements

1984 32

Substance Abuse and Mental Health Services Administration - Center for 

Behavioral Health Statistics and Quality National Survey on Drug Use and Health

1984 32

Appendix IV: Agency-Reported Oldest 

Systems or Investments
Appendix IV: Agency-Reported Oldest 

Systems or Investments

Page 47 GAO-16-468 Legacy Systems

Agency Investment/system

Year 

operational

Approximate 

age 

Department of 

Justice

Federal Bureau of Prisons SENTRY 1981 35

Federal Bureau of Prisons BOPNet 1981 35

Federal Bureau of Investigation Digital Collection 1993 23

Social Security 

Administration

Title II Systems 1985 31

FALCON Data Entry System 1991 25

Supplemental Security Income Record Maintenance System 1992 24

Department of 

State

Diversity Immigrant Visa Information System 1994 22

Immigrant Visa Information System 1994 22

Non-Immigrant Visa System 1995 21

Department of 

Transportation

Hazardous Materials Information System at Pipeline and Hazardous Materials 

Safety Administration

1970s ~46

Financial Management System of Saint Lawrence Seaway Development 

Corporation

1986 30

2001 TranStats (Bureau of Transportation Statistics) 2001 15

Department of 

the Treasury

Individual Master File 1960s ~56

Business Master File non-major 1960s ~56

Integrated Data Retrieval System 1973 43

Department of 

Veterans Affairs

Personnel and Accounting Integrated Data 1963 53

Benefits Delivery Network 1965 51

Electronic Health Record VistA 1981 35

Source: GAO analysis of agency documentation and interviews. | GAO-16-468

Notes: The systems and investments listed here may have components newer than the age listed.

a

The Department of Energy provided a list of multiple old investments. Because three were tied for 

second oldest, we include four investments here.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 48 GAO-16-468 Legacy Systems

We selected one system or investment per agency using a combination of 

factors including investment type (major or non-major), system or 

investment age, and risk level as of November 2015. In particular, we 

sought to have a mix of systems and investments that included both 

major and non-major investment types, a range of ages, and a range of 

risk ratings.

Appendix V: Profiles of 12 Legacy 

Investments or Systems
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 49 GAO-16-468 Legacy Systems

The Contractor Business Financial and Administrative Systems 

investment is intended to provide business and administrative systems for 

the Department of Energy’s (Energy) Savannah River Site’s1

management and operating contractor,2 liquid waste contractor, and the 

site security contractor to manage human resources (including payroll, 

benefits, and retirement for 13,000 employees and pensioners), 

transparent financial reporting to Energy, supply chain, and project 

management.

The investment is a commercial off-the-shelf system that runs on 

Windows and Unix servers using Oracle’s PeopleSoft applications. 

Specifically, the investment uses the PeopleSoft Supply Chain 

Management and PeopleSoft Financials modules. According to an 

agency official in Savannah River Operations, the vendors still support all 

of the hardware and software used by this investment.

The agency is not currently planning future modernization activity 

because the investment has gone through several updates in the past, 

with the last allowing the retirement of 16 associated legacy applications 

in 2011 and retired two mainframe systems. The officials stated that there 

is no projected end of life date, and they plan to continue to maintain and 

use the system.

 1

The Savannah River Site is an Energy industrial complex responsible for the 

environmental stewardship, environmental cleanup, waste management, and disposition 

of nuclear materials.

2

Management and operating contracts are agreements under which the government 

contracts for the operation, maintenance, or support, on its behalf, of a government-owned 

or -controlled research, development, special production, or testing establishment wholly 

or principally devoted to one or more of the major programs of the contracting federal 

agency. Federal Acquisition Regulation (FAR), 48 C.F.R. § 17.601.

Contractor Business 

Financial and 

Administrative Systems

Department of Energy

Number of users: 2,100 users

Investment start date: 2004

Age: 12 years

Investment anticipated end date: None

Fiscal year 2016 funding: $10.2 million

Total estimated life-cycle costs (through 

fiscal year 2016): $109.7 million

Development costs: $13.7 million

Operations and maintenance costs: $96.0 

million

Plans for retirement or modernization:

None
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 50 GAO-16-468 Legacy Systems

The Core Accounting System (CAS) Suite is the primary financial 

management system for the U.S. Coast Guard (USCG) and, as a shared 

service, the financial management system for the Transportation Security 

Administration (TSA) and the Domestic Nuclear Detection Office (DNDO). 

CAS is a set of several applications that assist the agencies in several 

areas, including accounts receivable, accounts payable, purchasing, 

asset management, procurement, and document imaging and processing.

According to the investment’s operational analysis document, CAS relies 

on outdated and heavily customized Oracle software and has become 

expensive to support. Specifically, it uses a version of Oracle Federal 

Financials software that was first available in 2004 and the extended 

vendor support for the software ended in November 2013. Further, it 

relies on Windows 2003 servers and any changes would require recoding 

of many functions within the CAS suite.

The agency plans to pursue using other shared services to provide its 

financial management services and, therefore, began the Financial 

Management Service Improvement Initiative to migrate the services from 

CAS to the Department of the Interior’s shared service offering for 

financial management. In August 2014, the agencies agreed to a 

staggered transition of these services, with DNDO transitioning in fiscal 

year 2016, TSA in fiscal year 2017, and USCG in fiscal year 2018. Until 

the migration is complete and CAS can be decommissioned, USCG plans 

to resolve emergent issues and maintain applications. In the meantime, 

due to the costs associated with implementing a full fix and the impending 

transition to shared services, USCG has accepted the security risks 

associated with its legacy software.

Department of Homeland Security—U.S. 

Coast Guard

Number of users: 14,000 Coast Guard users 

and also services the Transportation Security 

Administration

Investment start date: 1998

Age: 18 years

Investment anticipated end date: 2018

Fiscal year 2016 funding: $29.8 million

Total estimated life-cycle costs: $543.2 

million

Development costs: $0

Operations and maintenance costs: $543.2 

million

Plans for retirement or modernization:

Agency plans to transition to federal shared 

services in fiscal year 2018.

Core Accounting System 

Suite
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 51 GAO-16-468 Legacy Systems

The Diversity Visa Information System (DVIS) is an electronic case 

management system used by approximately 30 federal employees and 

contractor staff working at the Department of State’s (State) Kentucky 

Consular Center to track and validate application information submitted 

by foreign nationals under the Diversity Visa immigration program.3

The DVIS interface software, PowerBuilder, is no longer supported by the 

vendor. According to State officials, the main challenges in maintaining 

DVIS’s aging technology are related to information security and 

infrastructure concerns.

In 2013, State initiated an effort to replace numerous legacy systems, 

including DVIS. As a part of this effort, State plans to replace DVIS’s 

functionality with a project called ConsularOne. According to State 

officials, the replacement effort is to begin in October 2018 and they plan 

to retire DVIS when appropriate. In the meantime, the department plans 

to upgrade the unsupported software to a new version, which is also not 

supported.

 3

The Diversity Visa Program is provided by law to promote immigration from countries 

with historically low rates of immigration to the United States. The program creates an 

internet based lottery and randomly selects individuals from a pool of eligible entrants and 

qualifies them to apply for immigrant visas.

Diversity Visa Information 

System

Department of State

Number of users: Approximately 30 to 40 

consular center staff and 55,000 applicants 

annually

System start date: early 1990s

Age: Approximately 26 years

System anticipated end date: 2020

Fiscal year 2016 funding: about $164,000

Total estimated life-cycle costs: $2.4 million

Development costs: Not tracked at system 

level

Operations and maintenance costs: Not 

tracked at system level

Plans for retirement or modernization: 

Plans to replace with ConsularOne at an 

unknown time.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 52 GAO-16-468 Legacy Systems

The Department of Transportation’s (DOT) Hazardous Materials 

Information System maintains and provides access to comprehensive 

information on hazardous materials incidents, exemptions and approvals, 

enforcement actions, and other elements that support the regulatory 

program. The system consists of five modules that register carriers and 

shippers, document incidents involving hazardous materials, issue special 

permits, facilitate approvals and exemptions pertaining to safety 

regulations, and document standards.

Officials from Pipeline and Hazardous Material Safety’s Office of the Chief 

Information Officer stated that software applications and processes used 

by the system have become outdated and costly to maintain.4 For 

example, the system uses Microsoft.NET5 and Classic Active Server 

Pages.6 Officials stated that costs have increased due to maintaining the 

personnel with the knowledge to use these older applications. In 

particular, the costly applications include those for scanning, imaging, and 

documentation management. Further, these applications are 

compartmentalized, so data is duplicated and not integrated. Finally, the 

system uses an application that is no longer supported by the 

manufacturer, which can cause security risks, among other issues. 

Specifically, the system uses Kofax Indicius software to perform optical 

character recognition on scanned hazardous materials incident reports; 

the software was no longer supported by the vendor, as of December 

2014.

DOT is in the process of updating the functions performed by the system. 

The new system’s modules are intended to be integrated, automated, and 

improve efficiency, effectiveness, and data quality. Further, the 

unsupported application is planned to be eliminated. While DOT does not 

have dates for when individual legacy modules will be retired, officials 

stated that they plan to have all the legacy modules retired by the end of 

fiscal year 2018.

 4

According to Transportation, a photograph could not be provided due to security reasons.

5

Microsoft.NET is a general purpose development platform that provides capabilities for 

building applications. It was first available in 2002.

6

Active Server Pages enables web servers to dynamically generate web pages and create 

interactive web applications by using server-side scripting technology. Active Server 

Pages was first available in the late 1990s. 

Hazardous Materials 

Information System

Department of Transportation—Pipeline 

and Hazardous Materials Safety 

Administration

Number of users: 250 federal users, 547,000 

active hazardous materials facilities, 10,000 

active pipeline operators, and several million 

potential facilities

Investment start date: 1970s

Age: about 41 years

Investment anticipated end date: 2018

Fiscal year 2016 funding : $6.7 million

Total estimated life-cycle costs: $38.0 

million

Development costs: $22.7 million

Operations and maintenance costs: $15.3 

million

Plans for retirement or modernization:

Developing new system to replace legacy 

modules, and plan to retire the legacy 

modules by the end of fiscal year 2018.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 53 GAO-16-468 Legacy Systems

The Internal Revenue Service’s (IRS), Individual Master File (IMF) is the 

authoritative data source for individual taxpayer accounts. Within IMF, 

accounts are updated, taxes are assessed, and refunds are generated as 

required during each tax filing period. Virtually all IRS information system 

applications and processes depend on output, directly or indirectly, from 

this data source.

IMF was written in an outdated assembly language code7 and operates 

on a 2010 IBM z196/2817-m32 mainframe.8 This has resulted in difficulty 

delivering technical capabilities addressing identify theft and refund fraud, 

among other things. In addition, there is a risk of inaccuracies and system 

failures due to complexity of managing dozens of systems synchronizing 

individual taxpayer data across multiple data files and databases,

limitations in meeting normal financial requirements and security controls,

and keeping pace with modern financial institutions.

IRS plans to address these issues by replacing IMF with the Customer 

Account Data Engine 2 (CADE 2) investment. The CADE 2 investment 

includes plans to re-engineer the IMF by: (1) applying modern 

programming languages, (2) establishing CADE 2 as the authoritative 

data source, and (3) implementing functionality to address the IRS 

financial material weakness. However, the replacement date is currently 

unknown. In addition, we have previously reported on IRS’s difficulty in 

 7

Assembly language code is a low-level computer language initially used in the 1950s. 

Programs written in assembly language are conservative of machine resources and quite 

fast; however, they are much more difficult to write and maintain than other languages. 

Programs written in assembly language are also typically able to run only on the make of 

computer for which they were originally developed.

8

A large and very fast computer that can handle multiple tasks concurrently and to which 

other computers can be connected so that they can share facilities the mainframe 

provides. The term usually refers to hardware only, namely, main storage, execution 

circuitry, and peripheral units. According to Treasury, a photograph could not be provided

due to security reasons.

Individual Master File

Department of the Treasury—Internal 

Revenue Service

Number of users: Approximately 230 million 

tax accounts

Investment start date: 1960s

Age: Approximately 56 years

Investment anticipated end date: 2019

Fiscal year 2016 funding: $13.6 million

Total estimated life-cycle costs: $135.4 

million 

Development costs: $38.8 million

Operations and maintenance costs: $96.6 

million

Plans for retirement or modernization: Will 

be replaced by Customer Account Data 

Engine 2 at an unknown date.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 54 GAO-16-468 Legacy Systems

delivering planned capabilities on time and on budget.9 Further, a key 

phase of the replacement project was initially to be completed by March 

2015, but IRS is currently planning to complete parts of this phase well 

into 2020. As a result, the agency will continue to maintain two separate 

systems until the replacement is complete.

The Centers for Medicare and Medicaid Services’ Medicare Appeals 

System is a case tracking system that is to facilitate maintenance and 

transfer of case specific data with regard to Medicare appeals through 

multiple levels of the appeal process. In addition, the system is to provide 

the capability to report on appeals data and enable more accurate and 

expedient responses to Congressional questions.

The system runs on a Solaris 10 operating system, last updated in 

February 2016, and uses commercial off-the-shelf systems for case 

management and reporting. According to the agency, the software is still 

supported by the vendors. The system has faced challenges due to the 

rapid growth in appeals processed each year, expanded use of 

settlements, and the increased interest in appeals data. This has resulted 

in an increased need for infrastructure changes, such as more storage, 

licenses, and processing capacity.

Agency officials stated that they do not have any plans to address these 

gaps and that doing so is contingent on funding. They also noted general 

plans to continuously update the system, but they too are contingent on 

receiving funding.

 9

GAO, Information Technology: Management Needs to Address Reporting of IRS 

Investments’ Cost, Schedule, and Scope Information, GAO-15-297 (Washington, D.C.: 

Feb. 25, 2015).

Medicare Appeals System

Department of Health and Human Services 

– Centers for Medicare and Medicaid 

Services

Number of users: 1,900 system users

Investment start date: 2005

Age: 11 years

Investment anticipated end date: none

Fiscal year 2016 funding: $6.7 million

Total estimated life-cycle costs (through 

fiscal year 2017): $99.6 million

Development costs: $20.6 million

Operations and maintenance costs: $79.0 

million

Plans for retirement or modernization: The 

agency has general plans to continuously 

update the system.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 55 GAO-16-468 Legacy Systems

The National Weather Service Telecommunication Gateway (NWSTG) 

system is operated by the National Oceanic and Atmospheric 

Administration, a component of the Department of Commerce. It is the 

nation’s hub for the collection and distribution of weather data and 

products and provides national and global real-time exchange services 

using automated communications resources to collect and distribute a 

wide variety of environmental data such as observations, analysis, and 

forecast products. Thousands of customers worldwide use data 

distributed by the NWSTG and these data affect a wide range of 

economic and emergency management decisions.

Concerns with the system had been increasing because the investment 

faced risks and challenges associated with an aging and unsupportable 

infrastructure, limited backup capability, and un-scalable architecture to 

support future data volume collection and dissemination. In 2013, the 

agency upgraded its hardware and software to Power7 IBM servers and 

Unix operating systems (as depicted in the figure); however, NWSTG still 

lacks full backup capability for 26 percent of its functions.

National Weather Service 

Telecommunication 

Gateway

Department of Commerce—National 

Oceanic and Atmospheric Administration

Number of users: Thousands of users 

across the federal, state, and local levels, in 

addition to those in the international and 

academic communities

Investment start date: 1985

Age: 31 years

Investment anticipated end date: 2017

Fiscal year 2016 funding: $12.7 million

Total estimated life-cycle costs: $282.8 

million

Development costs: $35.4 million

Operations and maintenance costs: $247.4 

million

Plans for retirement or modernization: 

Agency plans to retire the system in fiscal 

year 2017 and replace it with a new system. 
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 56 GAO-16-468 Legacy Systems

Figure 7: National Weather Service Telecommunication Gateway Server

In fiscal year 2013, a major rearchitecture and redesign effort began

which, according to Department of Commerce officials, will result in an 

entirely new dissemination architecture which will replace the NWSTG 

with an integrated system that is more capable, more reliable, and have 

100 percent backup capability. According to officials, a detailed project 

plan to rearchitecture NWSTG is now being carried out and is scheduled 

to replace the NWSTG in early fiscal year 2017. 
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 57 GAO-16-468 Legacy Systems

The Personnel and Accounting Integrated Data (PAID) system automates 

time and attendance for employees, timekeepers, payroll, and 

supervisors in the Department of Veterans Affairs (VA). The PAID 

software has three major modules: Time and Attendance, Employee 

Master Record Downloads, and Education Tracking.

According to VA officials, PAID is a 50-year old COBOL-based10 system 

at the end of its life span. The system runs on IBM mainframes11 and 

uses an IBM database. Officials stated the system is not user friendly and 

requires extensive training in order to use the system successfully. As a 

result, the cost of maintaining the personnel to manage the system is 

high.

VA officials stated that PAID is intended to be mostly replaced by Human 

Resources Information System Shared Service Center in 2017, which is 

to consolidate human resources IT functions and services to provide core 

human resources-related functions, such as benefits and compensation. 

However, the target solution is experiencing cost overruns of $14.8 million 

and VA officials stated that they will not be able to replace all of PAID’s 

functions. The agency is currently working on a transition plan and will 

determine whether VA should find another solution for the missing 

functionality or continue to keep PAID running indefinitely.

 10COBOL is a programming language developed in the late 1950s and early 1960s. The 

Gartner Group, a leading IT research and advisory company, has reported that 

organizations using COBOL should consider replacing the language, as procurement and 

operating costs will steadily rise, and because there is a decrease in people available with 

the proper skill sets.

11A large and very fast computer that can handle multiple tasks concurrently and to which 

other computers can be connected so that they can share facilities the mainframe 

provides. The term usually refers to hardware only, namely, main storage, execution 

circuitry, and peripheral units.

Personnel and Accounting 

Integrated Data

Department of Veterans Affairs

Number of users: 2,900 system users across 

200 human resources offices

System start date: 1963

Age: 53 years

System anticipated end date: 2017

Fiscal year 2016 funding: $6.7 million

Total estimated life-cycle costs: n/a, not 

tracked by system

Development costs: n/a, not tracked by 

system

Operations and maintenance costs: $6.6 

million yearly

Plans for retirement or modernization: The 

system will mostly be replaced by the Human 

Resources Information System Shared 

Service Center, which will consolidate several 

IT services to provide core human resourcesrelated functions.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 58 GAO-16-468 Legacy Systems

The U.S. Department of Agriculture’s (USDA) U.S. Forest Service’s 

Resource Ordering and Status System (ROSS) is used to mobilize and 

deploy a multitude of resources, including qualified individuals, teams, 

aircraft, equipment, and supplies to fight wildland fires and respond to all 

hazard incidents. The system supports the basic needs of the first 

responders and support personnel at an incident location by processing 

orders and replenishing supplies.

According to the U.S Forest Service, the technology used by ROSS is on 

the verge of technical obsolescence. Specifically, one of the applications 

ROSS uses is no longer supported by the vendor, creating vulnerability 

issues. In addition, in order to use the system, users must download client 

software onto their local computers, as opposed to accessing the system 

through the web.

In September 2015, the U.S. Forest Service issued a request for 

information for services to develop ROSS’s replacement—Interagency 

Resources Ordering Capability. Additionally, in January 2016, Forest 

Service officials signed a charter to begin this project. Agency officials 

estimated that this effort will cost $14 million through fiscal year 2019 and 

the solution will go live in 2018.

Resource Ordering and 

Status System

U.S. Department of Agriculture—U.S. 

Forest Service

Number of users: more than 600 federal, 

state, and local agencies; 10,000 user 

accounts

Investment start date: 1998

Age: 18 years

Investment anticipated end date: 2018

Fiscal year 2016 funding: $5.5 million

Total estimated life-cycle costs: $106.2 

million

Development costs: $31.9 million

Operations and maintenance costs: $74.3 

million

Plans for retirement or modernization:

Being replaced in 2018.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 59 GAO-16-468 Legacy Systems

The Bureau of Prisons Sentry is a real-time information system comprised 

of various modules that are to enable the agency to maintain proper 

custody of persons committed to their custody. It provides information 

regarding security and custody levels, inmate program and work 

assignments, and other pertinent information about the inmate population. 

Sentry is used to process inmates at all phases of incarceration, including 

release, transfer, and sentence computation.

When Sentry was first deployed over 30 years ago, it was comprised of 

approximately 700 program routines written in COBOL12 and ran on a 

mainframe platform with an Integrated Database Management System 

database. It became increasingly more difficult and expensive to maintain 

complex, highly-customized systems written in older programming 

languages. Sentry’s entire platform—its mainframe operating system, 

transaction processing software, the system software, and the database 

software and system were recently updated in 2012 and uses Java and a 

new database. As part of this, the bureau migrated the older database, 

merged the legacy data into the newer database platform, and modified 

the COBOL programs to ensure compatibility with the new software and 

database. In addition, the legacy Sentry programs are now accessible via 

a web browser and use a relational database and both COBOL and Java 

programming languages.13

The bureau has plans for updating the user interface and integrating the 

data through September 2016. According to agency officials, there are no 

plans to replace Sentry, as the system is the main system used by the 

bureau.

 12COBOL is a programming language developed in the late 1950s and early 1960s. The 

Gartner Group, a leading IT research and advisory company, has reported that 

organizations using COBOL should consider replacing the language, as procurement and 

operating costs will steadily rise, and because there is a decrease in people available with 

the proper skill sets.

13According to the agency, a photograph could not be provided due to security reasons.

Sentry

Department of Justice—Bureau of Prisons

Number of users: 38,000 Bureau of Prisons 

staff, private institution staff, and other federal 

agencies

Investment start date: 1981

Age: 35 years

Investment anticipated end date: None

Fiscal year 2016 funding: $40.4 million

Total estimated life-cycle costs: $571.5 

million

Development costs: $9.8 million

Operations and maintenance costs: $561.7 

million

Plans for retirement or modernization:

Plans to update the user interface and 

integrate system data through September 

2016. Plans for continuous modernization.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 60 GAO-16-468 Legacy Systems

The Strategic Automated Command and Control System is the 

Department of Defense’s (Defense) dedicated high-speed data 

transmission, processing, and display system. The system coordinates 

the operational functions of the United States’ nuclear forces, such as 

intercontinental ballistic missiles, nuclear bombers, and tanker support 

aircrafts, among others. For those in the nuclear command area, the 

system’s primary function is to send and receive emergency action 

messages to nuclear forces.

According to Defense officials, the system is made up of technologies and 

equipment that are at the end of their useful lives. For example, the 

system is still running on an IBM Series/1 Computer, which is a 1970s 

computing system, and written in assembly language code.14 It also uses 

8-inch floppy disks, which are a 1970s-era storage device; and assembly 

programming code typically used in mainframes. Replacement parts for 

the system are difficult to find because they are now obsolete.

 14Assembly language code is a low-level computer language. Programs written in 

assembly language are conservative of machine resources and quite fast; however, they 

are much more difficult to write and maintain than other languages. Programs written in 

assembly language are typically able to run only on the make of computer for which they 

are originally developed.

Strategic Automated 

Command and Control 

System

Department of Defense—Air Force

Number of users: 175 users across 

command functions for intercontinental

ballistic missiles, bombers, tankers, munitions 

sites, intelligence, surveillance, and 

reconnaissance platforms

Investment start date: 1963

Age: 53 years

Investment anticipated end date: 2030

Fiscal year 2016 funding: $5.6 million

Total estimated life-cycle costs: $135 

million through 2032

Development costs: Approximately $60 

million

Operations and maintenance costs: $75 

million

Plans for retirement or modernization:

Defense is initiating a $60 million full system 

replacement which is scheduled to be 

completed in fiscal year 2020.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 61 GAO-16-468 Legacy Systems

Figure 8: Department of Defense Air Force Strategic Automated Command and 

Control System

As of March 2016, Defense is initiating a $60 million full system 

replacement which is scheduled to be completed in fiscal year 2020. In 

addition, Defense is also replacing some legacy functions in the near 

term—according to officials, there is a plan underway to replace the 

floppy disks with secure digital cards. This effort is underway and is 

expected to be completed in the fourth quarter of fiscal year 2017.
Appendix V: Profiles of 12 Legacy Investments 

or Systems

Page 62 GAO-16-468 Legacy Systems

The Social Security Administration’s (SSA) Title II investment includes the 

Title II system which determines retirement benefits eligibility and 

amounts, 162 subsystems, as well as several smaller IT improvement 

initiatives and projects. According to SSA officials, the Title II investment 

accomplished its goal to improve service delivery by eliminating 

antiquated Title II programs, reducing compartmentalized systems across 

the agency, and reducing maintenance costs through integration.

SSA officials stated that Title II is comprised of 162 subsystems and 

some are still written in COBOL.

15 These systems were also built in a 

compartmentalized structure by SSA, rather than contractors, because 

the agency determined that there were not commercial programs that 

could satisfy the agency’s business needs and the volume of data 

needed. SSA officials stated that most of the employees who developed 

these systems are ready to retire and the agency will lose their collective 

knowledge. Officials further stated that training new employees to 

maintain the older systems takes a lot of time.

SSA does not have plans to retire the Title II system. Rather, the agency 

plans to continue to eliminate and replace Title II’s older and more costly 

subsystems. Specifically, SSA currently is planning to retire four Title II 

subsystems, including a claims control system, and one that processes 

changes in earnings transactions. In addition, SSA has other efforts to 

modernize or consolidate Title II systems, such as its database 

management systems. To address the issues associated with losing 

knowledgeable employees, SSA officials stated that the agency has 

rehired retirees to work on the legacy systems.

 15COBOL is a programming language developed in the late 1950s and early 1960s. The 

Gartner Group, a leading IT research and advisory company, has reported that 

organizations using COBOL should consider replacing the language, as procurement and 

operating costs will steadily rise, and because there is a decrease in people available with 

the proper skill sets.

Title II Systems

Social Security Administration

Number of users: Services general public, 

1,300+ field offices with 50,000 to 60,000 

employees, as well as other federal agencies

System start date: 1985

Age: 31 years

Investment anticipated end date: None

Fiscal year 2016 funding: $9.6 million

Total estimated life-cycle costs (through 

fiscal year 2017): $519.8 million

Development costs: $235.7 million

Operations and maintenance costs: $284.1 

million

Plans for retirement or modernization:

Agency has ongoing modernization efforts.
Appendix VI: Comments from Department of 

Commerce

Page 63 GAO-16-468 Legacy Systems

Appendix VI: Comments from Department of 

Commerce
Appendix VI: Comments from Department of 

Commerce

Page 64 GAO-16-468 Legacy Systems
Appendix VII: Comments from the Department 

of Defense

Page 65 GAO-16-468 Legacy Systems

Appendix VII: Comments from the 

Department of Defense
Appendix VII: Comments from the Department 

of Defense

Page 66 GAO-16-468 Legacy Systems
Appendix VIII: Comments from the Department 

of Energy

Page 67 GAO-16-468 Legacy Systems

Appendix VIII: Comments from the 

Department of Energy
Appendix VIII: Comments from the Department 

of Energy

Page 68 GAO-16-468 Legacy Systems
Appendix IX: Comments from the Department 

of Health and Human Services

Page 69 GAO-16-468 Legacy Systems

Appendix IX: Comments from the 

Department of Health and Human Services
Appendix IX: Comments from the Department 

of Health and Human Services

Page 70 GAO-16-468 Legacy Systems
Appendix X: Comments from the Department 

of Homeland Security

Page 71 GAO-16-468 Legacy Systems

Appendix X: Comments from the Department 

of Homeland Security
Appendix X: Comments from the Department 

of Homeland Security

Page 72 GAO-16-468 Legacy Systems
Appendix XI: Comments from the Department 

of State

Page 73 GAO-16-468 Legacy Systems

Appendix XI: Comments from the 

Department of State
Appendix XI: Comments from the Department 

of State

Page 74 GAO-16-468 Legacy Systems
Appendix XII: Comments from the Department 

of Veterans Affairs

Page 75 GAO-16-468 Legacy Systems

Appendix XII: Comments from the 

Department of Veterans Affairs
Appendix XII: Comments from the Department 

of Veterans Affairs

Page 76 GAO-16-468 Legacy Systems
Appendix XIII: Comments from the Social 

Security Administration

Page 77 GAO-16-468 Legacy Systems

Appendix XIII: Comments from the Social 

Security Administration
Appendix XIII: Comments from the Social 

Security Administration

Page 78 GAO-16-468 Legacy Systems
Appendix XIV: GAO Contact and Staff 

Acknowledgments

Page 79 GAO-16-468 Legacy Systems

David A. Powner, (202) 512-9286 or pownerd@gao.gov

In addition to the contact name above, individuals making contributions to 

this report included Gary Mountjoy (assistant director), Kevin Walsh 

(assistant director), Scott Borre, Rebecca Eyler, Bradley Roach, Tina 

Torabi, and Jessica Waselkow.

Appendix XIV: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(100087)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.