Skip to main content

Information Technology: DHS Needs to Continue Addressing Critical Legacy Systems

GAO-23-106853 Published: May 31, 2023. Publicly Released: May 31, 2023.
Jump To:

Fast Facts

We testified about the Department of Homeland Security's attempts to update its aging IT systems. These legacy systems can be costly to maintain and vulnerable to hackers.

We recommended in 2019 that DHS develop a modernization plan for one of its most critical legacy systems. DHS did so in February 2022, and included milestones in the plan to replace this system and remove outdated hardware.

However, DHS hasn't implemented all of our recommendations to ensure its other legacy IT systems that support financial, biometric identity, and grants management are successfully replaced.

A bunch of old, unserviceable computer processing units stacked on top of each other

Skip to Highlights


What GAO Found

GAO reported in June 2019 that, of the 65 critical legacy IT systems identified by federal agencies as needing modernization, the Department of Homeland Security (DHS) had three such systems (see table). Further, GAO identified DHS's System 4 as one of the 10 most critical legacy systems across the federal government in need of modernization.

Table: Critical Legacy Systems in Need of Modernization According to DHS, as of June 2019

System namea

Age of system, in years

Age of oldest hardware, in years

System criticality (according to DHS)

Security risk (according to DHS)

System 4





System L




Moderately low

System M





Source: GAO analysis of Department of Homeland Security (DHS) data. | GAO-23-106853

aDue to sensitivity concerns, GAO substituted alphanumeric identifiers for the names of the agencies' systems. GAO assigned a number to identify each of the 10 most critical legacy systems in need of modernization and assigned a letter to identify the remaining 55 systems. The identifiers in the table reflect how DHS's system names appeared in the 2019 report (GAO-19-471).

In evaluating agencies' modernization plans for the 10 most critical legacy systems, GAO determined that DHS lacked a complete plan for modernizing System 4. Specifically, DHS's plan did not include milestones to complete the modernization and did not describe the planned disposition of the existing legacy system. In February 2022, DHS provided an updated modernization plan that included milestones for replacing the system and removing legacy hardware, which addressed our recommendation. By documenting its plan in sufficient detail, DHS increased the likelihood that the modernization will succeed.

GAO has also previously reported on DHS's efforts to modernize and replace other legacy systems that support financial management, biometric identity management, and grants management. Specifically,

  • In February 2023, GAO noted that, after attempting to modernize its financial management systems for decades, DHS implemented a governance structure to oversee component-level financial systems modernizations. However, the Coast Guard was unable to declare full operational capability as expected because it had not remediated issues from operational testing.
  • In June 2021, GAO reported that DHS's Homeland Advanced Recognition Technology program (intended to replace an outdated system for biometric identity management) was significantly behind schedule and had exceeded its estimated costs. GAO also found that DHS had not fully addressed key risk management and IT acquisition practices.
  • In April 2019, GAO reported that the Federal Emergency Management Agency's Grants Management Modernization program (intended to replace 10 legacy systems) had not fully addressed leading practices for business process reengineering, requirements, and cybersecurity risk management. The program also did not meet leading practices for a reliable schedule.

DHS has now implemented 11 of the 19 recommendations GAO made in these reports. Implementing the remaining eight will help the department ensure these critical legacy systems are successfully replaced.

Why GAO Did This Study

Each year, the federal government spends more than $100 billion on IT and cyber-related investments. Of this amount, agencies have typically reported spending about 80 percent on operations and maintenance of existing IT, including legacy systems. DHS's expected IT spending for fiscal year 2023 is about $10.1 billion; operations and maintenance is expected to consume about $8.8 billion of that total.

Maintaining legacy systems (i.e., systems that are outdated or obsolete) can pose significant challenges. GAO reported in 2016 that agencies had system components that were at least 50 years old and vendors that were no longer providing support for hardware or software. In 2019, GAO reported that several critical federal legacy systems used outdated languages, had unsupported hardware and software, and were operating with known security vulnerabilities.

GAO was asked to testify on its past legacy system reports and DHS's efforts to modernize. Specifically, GAO summarized (1) DHS's critical legacy IT systems and plan for modernizing and (2) progress and challenges with selected DHS IT modernizations. This statement is based on issued GAO reports and updated information on the department's implementation of GAO's recommendations.


In a 2019 report, GAO recommended to DHS that it develop a modernization plan for its most critical legacy system. The department implemented this recommendation and has implemented several GAO recommendations on modernizing other legacy systems.

Full Report

GAO Contacts

Office of Public Affairs


Best practicesBusiness systems modernizationChief information officersCybersecurityIT investmentsInformation systemsInformation technologyLegacy systemsRisk managementSecurity risksSoftware