How a fixed-fee refresh assessment for one agency data center inventories what is past end of support, sequences the refresh inside the existing footprint, and sets the latest date each hardware order can be placed.
Most agencies still run an on-premises data center, and much of what sits in it is reaching end of support at the same time. SQL Server 2016 left Microsoft support on July 14, 2026. Windows Server 2016 follows on January 12, 2027. CISA BOD 26-02 (February 2026) puts end-of-support edge devices on a retirement schedule. When a component stops receiving vendor fixes, the plan of action and milestones (POA&M) entries tied to it cannot be closed by patching. They can only be closed by replacing the component.
OMB M-19-19, issued in June 2019, told agencies not to build or significantly expand agency-owned data centers without OMB approval. Modernization therefore happens inside the existing footprint, on a calendar set by vendor support dates, hardware lead times, change windows and fiscal-year money. Few agencies still have the in-house data center engineers who used to plan that work.
This paper is for infrastructure branch chiefs, the CIO who funds refresh, ISSMs holding findings they cannot close, and the CORs who buy the work. It describes Avalon Technology Services' Data Center Implementation service, which starts with one engagement:
Section 9 works through an illustrative site. As of October 1, 2026, 18 database instances are already past end of support and 168 more items reach it within 12 months. Even with hardware ordered six weeks after the roadmap, the last Windows Server 2016 workloads move about 196 days after that product's end of support. The roadmap cannot erase that gap; it sizes it and sets the latest date for each order.
Avalon specifies; the agency buys the hardware and licenses. Avalon does no electrical, cooling or construction work, resells nothing, and does not grant or certify an authorization. The agency's assessor assesses controls, and the Authorizing Official (AO) decides.
The need shows up in the same phrases across agencies. Each one points to a refresh that should have started a budget cycle ago.
| What the branch chief or ISSM says | What it usually means |
|---|---|
| "Everything's on extended support." | Several platform generations are reaching end of support together, and the extensions are buying time, not a plan |
| "We can't get parts anymore." | Hardware support has lapsed; a failure becomes an outage instead of a ticket |
| "Our POA&M has findings we literally cannot close." | Unsupported components get no vendor fixes, so remediation means replacement |
| "The last contractor moved 80% to the cloud and left." | What stayed behind is undocumented, underused and still on the books |
| "One more summer like the last one and that room cooks." | Facility capacity is a constraint the facility owner must confirm before any build |
| Driver | What it says | What it means for this engagement |
|---|---|---|
| OMB M-19-19 (issued June 2019) | Data Center Optimization Initiative; no new or significantly expanded agency-owned data centers without OMB approval | Modernize inside the existing footprint; the roadmap does not propose new floor space |
| SQL Server 2016 and Windows Server 2016 end of support | Jul 14, 2026 and Jan 12, 2027 | Database instances are already unsupported; server workloads follow in FY2027 Q2 |
| CISA BOD 26-02 (Feb 6, 2026) | End-of-support edge devices: inventory in 3 months, decommission in 12, replace in 18 | Edge firewalls and VPN appliances go to the front of the order queue |
| CISA BOD 26-04 (Jun 10, 2026) | Replaced BOD 22-01 and BOD 19-02; risk-based remediation clocks of 3, 14 and 60 days | An unsupported component cannot meet a remediation clock, which is the urgency case |
| NIST SP 800-53 Rev. 5 | CM-8 component inventory, SA-22 unsupported system components, SI-2 flaw remediation | The inventory and end-of-support register are direct evidence |
| NIST SP 800-37 Rev. 2 | Seven-step RMF, Prepare through Monitor | A rebuilt environment re-enters RMF; the build follow-on delivers the Implement step |
| OMB M-26-14 (May 2026) | Risk-based logging model; replaced M-21-31 | New hosts and appliances must feed the agency's logging from day one |
Typical triggers: an end-of-support wave, a lease or building decision, a power or cooling outage, an inspector general or GAO finding, a stranded estate after a cloud move, or a virtualization renewal quote. Much of the work is funded in the fourth-quarter operations and maintenance sweep.
The assessment comes before any hardware order or build. It establishes what is actually in the room, what each item depends on, when each one runs out of support, and what order of work gets the site to a supported state with the least exposure.
| Workstream | Activities |
|---|---|
| Discovery and baseline | Automated inventory from the agency's virtualization exports (for example RVTools) and existing discovery tools; application-to-server dependency mapping; capacity and usage baseline; a physical walk with the facility owner covering rack elevations, cabling and per-circuit power readings |
| End-of-support register | Every host, VM operating system, database instance, storage array, switch and edge appliance with its end-of-support date and source, mapped to the POA&M items it blocks |
| Options analysis | Refresh, replatform, retire or hand to cloud migration per class; platforms (vSphere, Nutanix AHV, Hyper-V or OpenShift Virtualization) weighed on the agency's licensing and skills |
| Refresh sequencing | Wave order, change-window assumptions, lead-time bands and the latest order date for each hardware class, with the fiscal year each buy falls in |
| BOM specification and IGCE support | Vendor-neutral specifications annotated for TAA and Section 889, plus an IGCE input; Avalon sells no hardware |
| Roadmap and briefing | A sequenced modernization roadmap inside the existing footprint, and a briefing for the CIO, branch chief and ISSM |
| Deliverable | Format |
|---|---|
| Current-state assessment and dependency map | PDF report plus source data in XLSX or JSON |
| End-of-support register and sequencing workbook | XLSX, with every date and assumption editable by the agency |
| Options analysis and modernization roadmap | PDF, with a one-page summary for the budget office |
| Vendor-neutral BOM specification with TAA and Section 889 annotations | XLSX |
| IGCE support worksheet | XLSX |
| Executive briefing | Slide deck and live outbrief |
The assessment produces a plan and a specification. Detailed high-level and low-level design, the build, migration waves and decommissioning are separately priced follow-ons. Workloads bound for commercial cloud go to Avalon's separate Cloud Migration & Development service; steady-state operation goes to its Network/Database Administration and Enterprise Monitoring services.
| Control or task | Evidence produced | When |
|---|---|---|
| CM-8 | Validated component inventory with owners and dependencies | Assessment |
| SA-22 | End-of-support register with replacement dates and a documented plan for each unsupported component | Assessment |
| SI-2 | POA&M items mapped to the replacement that closes them | Assessment |
| CM-2, CM-6 | Baseline configurations hardened to DISA STIGs or CIS Benchmarks, with SCAP output | Build follow-on |
| MA-2, MA-4 | Maintenance and remote-maintenance procedures in the turnover package | Build follow-on |
| CP-6, CP-7, CP-9 | Backup and alternate-site posture documented for the rebuilt environment | Build follow-on |
| SC-7 | Boundary design for the replacement edge and data center network | Build follow-on |
| MP-6 | NIST SP 800-88 sanitization certificates per device, with chain of custody | Decommission follow-on |
PE-family physical controls belong to the facility owner; Avalon records what the owner confirms and does not assess it. The accurate way to state the value of the full service: Avalon delivers a STIG-hardened, fully documented environment with assessment-ready configuration artifacts. Control assessment and the authorization decision remain with the agency's assessor and Authorizing Official.
| Accurate | Not accurate |
|---|---|
| An inventory and end-of-support register the ISSM can attach to POA&M items | Closes findings by itself |
| Assessment-ready configuration artifacts from the build | Grants, guarantees or speeds an ATO |
| A roadmap inside the existing footprint | Makes the agency compliant with data center policy |
| Phase | Timing | What happens |
|---|---|---|
| Kickoff and access | Week 1 | Confirm the site and caps, start badging and escort arrangements on day one, issue the data call, request read-only privileged access |
| Discovery | Weeks 1–3 | Inventory exports, dependency interviews with application owners, usage baseline, physical walk with the facility owner |
| Register and validation | Weeks 3–4 | End-of-support register and dependency map reviewed and corrected with the branch chief |
| Options and roadmap | Weeks 4–5 | Options analysis, sequencing workbook, BOM specification, IGCE support |
| Briefing | Weeks 5–6 | Draft roadmap, five-business-day agency review, final deliverables, executive outbrief |
| Included | Separate work |
|---|---|
| Recording facility-owner capacity confirmations | Electrical, UPS, generator, cooling, fire suppression or construction |
| A vendor-neutral BOM specification | Hardware or license sales, OEM quotes or reseller margins |
| A sequenced roadmap | Detailed design, build, migration and decommissioning |
| Evidence for the ISSM and assessor | The control assessment, the ATO or any certification |
| Unclassified sites | Classified or air-gapped environments |
Avalon takes one engagement at a time, works business hours, and works on unclassified sites only. Avalon's founder serves as project manager. The technical lead is a named infrastructure architect, with a named cybersecurity engineer part time. Avalon has no past federal engagements under this service. FAR 15.305 says an offeror without a record of past performance may not be evaluated favorably or unfavorably on that factor; what protects the agency is a named team, a fixed price, capped scope and a short schedule. Avalon never assesses an environment it designed or built.
| Requirement | How it is handled |
|---|---|
| Infrastructure architect and cybersecurity engineer | Named personnel whose certifications and investigation level match the agency's requirements, listed in the proposal, hired or subcontracted |
| DoD privileged access | Qualification under the DoD cyber workforce rules the site requires, as a condition of the engagement |
| Site access | Public Trust or clearance at the level the site requires, as a condition of the engagement |
| Hardware channel | None; Avalon holds no OEM or reseller partnership and sells no hardware or licenses |
| Insurance and contract vehicles | Any coverage the solicitation requires is a condition of award; Avalon does not hold a GSA Schedule or a governmentwide contract today |
| Engagement | Market-norm services price | Duration | Avalon |
|---|---|---|---|
| Tier 0: assessment and roadmap, one site | $35K–$75K FFP | 4–6 weeks | Offered now, firm fixed price |
| Tier 1: server room or edge site (up to 5 racks, 50 workloads) | $75K–$250K | 2–4 months | Follow-on, one at a time |
| Tier 2: single data center refresh or consolidation (10–40 racks, 50–300 workloads) | $250K–$900K | 5–10 months | Only when carefully scoped; above the SAT it goes through a prime |
| Tier 3: multi-site program | $1M–$5M+ | 12–24 months | Not offered |
Hardware typically runs 1.5 to 4 times the services value; the agency buys it through its own channels, such as NASA SEWP, against the BOM specification. Avalon uses one rate card across its Cloud & IT Infrastructure Services work: architect $160 to $210 an hour, infrastructure engineer $115 to $155, cybersecurity engineer $140 to $185, and project manager $125 to $165.
The Tier 0 assessment sits under the $350,000 simplified acquisition threshold, so it can be bought as an open-market purchase. Purchases between the $15,000 micro-purchase threshold and the SAT are generally set aside for small business when two or more capable small businesses are expected to compete. A prime holding a larger infrastructure task order can subcontract the work to Avalon. Avalon does not hold a GSA Schedule or a governmentwide contract today.
The figures below are a planning illustration for one representative site, not a quote and not a result from any engagement. The Windows Server 2016 and SQL Server 2016 dates are the published end-of-support dates; every other date, count and rate is an assumption the agency replaces with its own data.
| Component class | Count | End of support | Refresh path |
|---|---|---|---|
| SQL Server 2016 database instances | 18 | Jul 14, 2026 | Upgrade; move first |
| Windows Server 2016 virtual machines (including the 18 database VMs) | 140 | Jan 12, 2027 | Rebuild on a supported OS, retire, or hand to cloud migration |
| Edge firewall and VPN appliances | 2 | Dec 31, 2026 | Replace (BOD 26-02 scope) |
| Virtualization hosts and storage arrays | 26 | Sep 30, 2027 | Refresh as one buy |
| Data center switches | 12 | Mar 31, 2028 | Refresh in FY2028 |
| Virtual machines on a supported OS | 80 | Outside window | Move as is |
| Quarter end | SQL 2016 instances | Windows 2016 VMs | Edge appliances | Hosts and storage | Items past end of support |
|---|---|---|---|---|---|
| FY27 Q1 (Dec 31, 2026) | 18 | 0 | 2 | 0 | 20 |
| FY27 Q2 (Mar 31, 2027) | 18 | 140 | 2 | 0 | 160 |
| FY27 Q3 (Jun 30, 2027) | 18 | 140 | 2 | 0 | 160 |
| FY27 Q4 (Sep 30, 2027) | 18 | 140 | 2 | 26 | 186 |
| FY28 Q1 (Dec 31, 2027) | 18 | 140 | 2 | 26 | 186 |
If nothing changes, 186 items are past end of support by the end of FY2027, and every POA&M item tied to them stays open because no vendor fix will come.
The base case assumes the roadmap is delivered Dec 7, 2026, the agency places hardware orders 6 weeks later (Jan 18, 2027), lead times sit mid-band, the build takes 8 weeks, and the agency grants 2 change windows a week at 6 migration units each. Database VMs move first and count double; discovery retires 10% of the other VMs.
| Scenario | Hosts ready | Last SQL 2016 move (days past EOS) | Last Windows 2016 move (days past EOS) | All moves done | Before host support ends? |
|---|---|---|---|---|---|
| Base | May 3, 2027 | May 24, 2027 (314) | Jul 27, 2027 (196) | Sep 7, 2027 | Yes, 3.3 weeks spare |
| Top of lead-time bands | May 24, 2027 | Jun 14, 2027 (335) | Aug 17, 2027 (217) | Sep 28, 2027 | Yes, 0.3 weeks spare |
| One change window a week | May 3, 2027 | Jun 14, 2027 (335) | Oct 20, 2027 (281) | Jan 12, 2028 | No, 14.9 weeks late |
| Four change windows a week | May 3, 2027 | May 13, 2027 (303) | Jun 14, 2027 (153) | Jul 5, 2027 | Yes, 12.4 weeks spare |
| 25% of VMs to cloud migration | May 3, 2027 | May 24, 2027 (314) | Jun 30, 2027 (169) | Aug 11, 2027 | Yes, 7.1 weeks spare |
Three things stand out. First, no sequence gets the database and Windows Server 2016 workloads off unsupported software in time; the agency needs a documented interim position, such as vendor extended-support terms or an AO risk acceptance. Second, change windows matter more than lead times: one window a week pushes the last move to Jan 12, 2028, after the hosts themselves lose support, while four windows finish by Jul 5, 2027. Third, sending 46 VMs to cloud migration shortens the moves by about 3.9 weeks, without changing the order of work.
| Hardware class | Lead-time band | Latest order, mid-band | Latest order, top of band | Fiscal year |
|---|---|---|---|---|
| Edge firewall and VPN appliances | 6–16 weeks | Oct 1, 2026 (passed) | Aug 27, 2026 (passed) | FY2027 |
| Virtualization hosts and storage arrays | 4–10 weeks | Feb 9, 2027 | Jan 19, 2027 | FY2027 |
| Data center switches | 6–16 weeks | Dec 3, 2027 | Oct 29, 2027 | FY2028 |
The edge pair is already late at both ends of its band, so it is ordered as soon as the assessment confirms the specification, and the agency's own BOD 26-02 plan sets the interim position. The host and storage refresh must be ordered by Jan 19, 2027 if lead times run to the top of the band, leaving almost no slack against the planned order date. The switch refresh can wait for FY2028 money, but only if it is programmed now. The build follow-on for this site (26 hosts, about 200 workloads) falls in the Tier 2 band and is bought separately, through a prime if it exceeds the SAT.
| Case | Staffing | Hours | Range at rate card | Inside $35K–$75K? |
|---|---|---|---|---|
| 4 weeks | Architect 0.75, cyber 0.25, PM 0.25 | 200 | $30K–$39K | Low end under the floor; priced at $35K |
| 5 weeks (base) | Architect 0.75, cyber 0.25, PM 0.25 | 250 | $37K–$49K | Yes |
| 6 weeks | Architect 0.75, cyber 0.25, PM 0.25 | 300 | $45K–$59K | Yes |
| Larger site, 6 weeks | Architect 1.0, engineer 0.5, cyber 0.25, PM 0.25 | 480 | $68K–$90K | No; upper rates break the ceiling |
At 40 hours a week, the base case runs 250 hours and $37K to $49K; Avalon would quote about $43K. Four weeks falls below the $35K floor at low rates, so $35K is the minimum. A larger site needing a full-time architect and a half-time engineer breaks the $75K ceiling at upper rates, so the assumptions table caps the scope at 1 site, 250 VMs, 40 physical hosts and 20 racks.
| Pitfall | How to avoid it |
|---|---|
| "While you're in there" application fixes | Application changes are separate work; the roadmap names them |
| Facility surprises | Facility-owner confirmation of power, cooling and floor loading before any build |
| Undocumented dependencies | Dependency interviews in discovery; capped re-plans in the follow-on |
| Ordering after the window closes | Latest order dates in the roadmap, by fiscal year |
| Hardware bundled into the services price | The agency buys hardware against the BOM; Avalon sells none |
| Overselling the result | Use the accurate phrasing; the assessor and the AO decide |
End of support does not wait for the budget cycle. A site that knows what it has, when each item runs out, and the latest date each order can go out can make the gap short and visible. A site that finds out from a failed part or an unclosable finding has fewer options left.
The natural first step is the fixed-fee assessment: one unclassified site, four to six weeks, under the simplified acquisition threshold, ending in a validated inventory, an end-of-support register, a sequenced roadmap inside the existing footprint and a vendor-neutral BOM specification. To discuss a site, contact Avalon Technology Services at contact@AvalonTechServices.com.
BOM
Bill of materials: the hardware and software specification the agency buys against.
End of support (EOS)
The date after which a vendor stops issuing fixes for a product.
IGCE
Independent government cost estimate, prepared by the government before a purchase.
SCAP
Security Content Automation Protocol; automated checks that produce configuration evidence.
STIG
Security Technical Implementation Guide, the DISA configuration standard for a product.
All values are planning assumptions for one representative site. None is drawn from a specific agency or a completed engagement.
| Assumption | Value | Basis |
|---|---|---|
| Snapshot and kickoff | Status quo at Oct 1, 2026; kickoff Nov 2, 2026; roadmap Dec 7, 2026 | Planning assumption |
| Order placement | 6 weeks after the roadmap (Jan 18, 2027) | Planning assumption |
| Lead times | Servers and storage 4–10 weeks; switching and edge 6–16 weeks; mid-band in the base case | Market-norm bands |
| Build | 8 weeks for hosts and storage; 2 weeks for the edge pair; 6 weeks for switching | Planning assumption inside market-norm ranges |
| Migration | 6 units per window, 2 windows a week; database VMs count 2 units | Planning assumption |
| Non-Microsoft end-of-support dates | Edge Dec 31, 2026; hosts and storage Sep 30, 2027; switches Mar 31, 2028 | Planning assumption |
| Rates and loading | Avalon rate card; architect 0.75, cyber 0.25, PM 0.25 at 40 hours a week | Market norms |
| Scope caps | 1 site, 250 VMs, 40 hosts, 20 racks; re-price above 10% | Model rule |
