How a fixed-fee legacy disposition assessment scores one bureau's portfolio, assigns keep, fix, replace or retire to every system with its authorization impact, and builds a funded roadmap with decommission criteria written before any build.
Most federal modernization budgets are already being spent, just not on modernization. GAO has reported for years that most federal IT spending goes to operating and maintaining existing systems. The money that could replace an aging platform is the money that keeps it running, and every year the platform gets older, the people who can safely change it get fewer, and the list of security findings that cannot close without a platform change gets longer.
The usual response is a multi-year rewrite with no working software until the end. What most bureaus need first is smaller: a documented decision for every system in a bounded portfolio, with its authorization impact and a funding path.
This paper is for CIOs, system owners, chief architects, CFOs, CISOs and ISSMs, and the CORs who buy the work. It describes Avalon Technology Services' IT Modernization service, which starts with one engagement:
Section 9 works through an illustrative ten-system portfolio carrying $11.1M a year in operations and maintenance (O&M). The three largest systems carry 62% of that cost. Three systems score as retire candidates whose one-time transition cost pays back in about four to five months of eliminated run cost. The illustrative assessment fee is $78K.
The service assesses and engineers. It does not grant, guarantee or speed an authorization. Security assessment and authorization decisions remain with the agency's assessors and Authorizing Official (AO), and savings are counted only after a system is actually turned off.
Each of these familiar phrases points to a decision not yet made.
| What the agency says | What it usually means |
|---|---|
| "Our O&M eats most of the budget." | No one has ranked which systems cost the most to run and which could be retired |
| "The one person who knows it is retiring." | Staffing depth is a risk factor nobody has scored or funded |
| "We have POA&M items we literally cannot close without replacing the platform." | The finding is a modernization decision wearing a security label |
| "GAO (or the IG) flagged us and leadership wants a plan." | Oversight wants a defensible roadmap, not a slide |
| "Our last modernization attempt failed." | The last attempt was too big to cancel and had no working software until the end |
| "We can't get our data out of it." | Every new initiative, including AI, is blocked by one platform |
| Driver | What it requires | What it means for this engagement |
|---|---|---|
| NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5 | RMF steps for changed systems; the current control catalog | Every disposition gets an authorization-impact note for the ISSM |
| OMB M-22-09 (Jan 26, 2022) and CISA Zero Trust Maturity Model 2.0 | Civilian zero trust strategy across identity, devices, networks, applications and workloads, and data | Target architecture notes show which pillars each increment advances |
| DoD Zero Trust Strategy | Target-level zero trust capabilities by the end of FY2027 | Legacy platforms that cannot meet target level are scored as such |
| CISA BOD 26-02 (Feb 6, 2026) | End-of-support edge devices: inventory in 3 months, decommission in 12, replace in 18 | End-of-support dates feed the risk score and the roadmap sequence |
| CISA BOD 26-04 (Jun 10, 2026) | Risk-based remediation clocks; replaced BOD 22-01 and BOD 19-02 | Unpatchable platforms are flagged where a clock cannot be met |
| OMB M-26-14 (May 2026) | A risk-based logging model; replaced M-21-31 | Logging requirements are written into the target architecture |
| OMB M-26-05 (Jan 23, 2026) | Agencies set risk-based software assurance policies; NIST SP 800-218 (SSDF) is guidance | Increments follow the agency's own policy; SBOMs only where the contract asks |
| FedRAMP Consolidated Rules (Jun 25, 2026) | Offerings are "FedRAMP Certified" in classes A through D; certification covers the provider's offering only | A cloud or SaaS destination still needs the agency's own authorization |
| TMF, working capital funds, FITARA | TMF was extended through Sep 30, 2026; agencies should confirm its current status. GAO-26-107737 (2026) found small TMF savings so far | The funding strategy names more than one path |
| DoD RMF under CSRMC (Sep 24, 2025) | RMF, DoDI 8510.01 and eMASS remain in use | Unclassified DoD components follow the same pattern |
Typical triggers: a GAO, IG or FISMA finding that names a system; Windows Server 2016 end of support in January 2027; a BOD 26-02 edge device inventory; the last maintainer retiring; a funding decision; and year-end O&M funds.
The assessment is destination-agnostic. It does not start from "move to the cloud" or "buy a product". It starts from the portfolio and asks one question per system: keep, fix, replace or retire. Its signature outputs are retire and tolerate decisions, funding paths and decommission criteria.
| Step | Activities |
|---|---|
| Kickoff and data call | Government lead and steering cadence confirmed, dependencies dated in writing, data call issued for costs, contracts, diagrams and SSPs |
| Inventory and dependencies | Every in-scope system, its interfaces, its data stores, its incumbent O&M contract and who can change it |
| Risk scoring | Age, platform supportability, staffing depth, end-of-support exposure, unclosable POA&M items and mission criticality, on weights agreed at kickoff |
| Disposition | Gartner TIME quadrant (tolerate, invest, migrate, eliminate) plus a 7R pattern (rehost, replatform, refactor, rearchitect, replace, retire, retain), with written rationale |
| Authorization impact | For each disposition: whether the boundary changes, which RMF steps re-open and which POA&M items the change would remediate |
| Roadmap and funding | Target architecture outline, increments sequenced by risk and dependency, rough-order cost, and funding options |
| Decommission criteria | For every retire or replace decision: the exit test, a capped parallel run and the records disposition, written before any build |
Avalon works in the agency's own repositories and tools. Code analysis uses tools the agency already licenses or approves, and no agency data leaves the agency environment.
| Deliverable | Format |
|---|---|
| Legacy Portfolio Assessment and Risk Report | PDF report and scoring workbook (Excel) |
| Disposition Matrix | Excel, with a one-page summary per system |
| Target Architecture Outline | Diagrams, architecture decision records, zero trust alignment notes |
| Roadmap and Funding Strategy | Briefing deck and narrative; TMF proposal support where the agency pursues it |
| Authorization-impact notes and boundary-change inputs | Word, for the ISSM's SSP and POA&M |
| Decommission criteria per retire or replace decision | Word, written as statement-of-work language |
| Readout | Live briefing to the CIO, system owners, CISO and CFO |
The assessment does not design landing zones, plan migration waves, build pipeline evidence or mature delivery pipelines; those are separate Avalon services. It does not resell hardware or software, provide staff augmentation, take on long-term O&M, transform mainframe code or work in classified environments.
Replacing a platform changes components; retiring a system removes interfaces from other systems' boundaries; moving to a FedRAMP Certified service leaves the agency to authorize its own use. An authorization to operate does not carry over to a new platform by default. The assessment makes those effects visible before money is committed, so the ISSM plans for them instead of discovering them at cutover.
| Control area | What the assessment documents |
|---|---|
| CM-8 (system component inventory) | The in-scope components, interfaces and owners |
| SA-22 (unsupported system components) | Components past or near end of support, with dates |
| CA-5 (plan of action and milestones) | Open items that cannot close without a platform change, by system |
| PL-2 (system security plan) | Boundary-change inputs for each disposition |
| SI-2 (flaw remediation) | Platforms that cannot meet BOD 26-04 clocks |
| AU family | Logging gaps against the agency's M-26-14 decisions |
| Accurate | Not accurate |
|---|---|
| Identifies the technology conditions behind open POA&M items and which disposition would remediate them | Closes POA&M items |
| Produces boundary-change inputs for the ISSM | Achieves, preserves or speeds an ATO |
| A defensible disposition for every system | Brings the bureau into FISMA compliance |
| A break-even estimate per retire decision | Guarantees a savings percentage |
| Phase | Timing | What happens |
|---|---|---|
| Initiation and access | Agency-dependent | Accounts, badging, tool access, data call; dated as government-furnished dependencies |
| Discovery and scoring | Weeks 1–5 of work | Inventory, dependency mapping, SME interviews, risk scoring |
| Disposition and authorization impact | Weeks 4–7 | TIME and 7R decisions, one-page summaries, ISSM review |
| Roadmap, funding and readout | Weeks 7–8 | Increment sequence, funding options, decommission criteria, five-business-day agency review, final briefing |
| Pilot follow-on (separate, conditional) | 4–7 months | One system, 8–12 week increments, each ending in working software and a cancel-or-continue decision |
The base case is about eight weeks of work after access; federal onboarding time is dated separately.
| Included | Separate work |
|---|---|
| A disposition for every in-scope system | Executing the dispositions, unless bought as the pilot follow-on |
| Authorization-impact notes | Writing the SSP, managing the POA&M or the authorization package |
| Funding options and TMF proposal support | Guaranteed funding or savings |
| Destination-agnostic target outline | Landing zones, migration waves or cloud design |
| Licensing and procurement advice | Hardware, software or license resale |
| Knowledge transfer | Long-term O&M or staff augmentation |
| Unclassified systems | Classified, IC or mainframe transformation scope |
Avalon takes one engagement at a time, works business hours, and works on unclassified systems only. Avalon's founder serves as engagement lead and project manager at full time, with one named modernization architect at half time. Avalon has no past federal engagements under this service. FAR 15.305 says an offeror without a record of past performance may not be evaluated favorably or unfavorably on that factor; what protects the agency is a named team, a fixed price and a bounded scope.
Because the assessment shapes the follow-on statement of work, Avalon raises organizational conflict of interest (FAR subpart 9.5) before the contracting officer does. Assessment deliverables are vendor-neutral, and the agency may choose to treat Avalon as assessment-only on that program.
| Requirement | How it is handled |
|---|---|
| Modernization architect | Named personnel whose certifications and investigation level match the agency's requirements, listed in the proposal, hired or subcontracted |
| Security credential for the ISSM liaison role | A certified security lead named in the proposal where the agency requires one |
| Civilian or DoD access | Public Trust or the investigation level the agency requires, as a condition of the engagement; DoD privileged access only with personnel who meet the agency's workforce requirements |
| Data handling | Work stays in the agency's environment; no Avalon-side handling of controlled unclassified information |
| Pilot follow-on | Offered only with named hires for the technical lead and engineers, listed in the proposal |
| Insurance and contract vehicles | Any coverage the solicitation requires is a condition of award; Avalon does not hold a GSA Schedule or a governmentwide contract today |
| Engagement | Market-norm range | Avalon |
|---|---|---|
| A: Legacy disposition assessment, up to about 25 systems, 6–12 weeks | $60K–$250K | Firm fixed price; illustrative $78K for ten systems |
| B: Pilot modernization of one system, 4–7 months | $250K–$1.2M | FFP milestones or T&M with a not-to-exceed; conditional, with named hires |
| C: Multi-system program, 12–36 months | $1.5M–$8M per year | Not offered today |
The assessment sits under the $350,000 simplified acquisition threshold, so it can be bought as an open-market purchase. Purchases between the $15,000 micro-purchase threshold and the SAT are generally set aside for small business when two or more capable small businesses are expected to compete. Above the SAT, or inside a larger modernization task order, a prime can subcontract the work to Avalon. Time-and-materials pricing requires a timekeeping system the government accepts; Avalon does not propose cost-reimbursement.
Prices are fixed against a named system list. A system added after kickoff is priced from the per-system hours in Section 9. It costs a fraction of one year of the O&M it examines.
The figures below are a planning illustration for one representative unclassified bureau portfolio, not a quote and not a result from any engagement. In a real assessment the agency enters every per-system value, and the weights are agreed at kickoff.
| System | Platform | O&M/yr | Age | Maint. | POA&M | Risk | Crit. |
|---|---|---|---|---|---|---|---|
| S1 Grants management | Oracle Forms | $2.9M | 22 | 2 | 7 | 86 | 5 |
| S2 Case management | COBOL batch, Java front end | $2.4M | 31 | 1 | 4 | 82 | 5 |
| S3 Financial interface hub | .NET Framework on Windows Server 2016 | $1.6M | 15 | 3 | 5 | 70 | 4 |
| S4 Licensing portal | Classic ASP | $900K | 19 | 1 | 6 | 94 | 2 |
| S5 Document imaging | Vendor product, on premises | $1.1M | 12 | 2 | 2 | 56 | 3 |
| S6 Reporting warehouse | Relational database, scheduled ETL | $700K | 10 | 3 | 3 | 51 | 3 |
| S7 Training records | PowerBuilder | $300K | 20 | 1 | 2 | 88 | 1 |
| S8 Facilities requests | Desktop database with macros | $150K | 17 | 1 | 2 | 72 | 1 |
| S9 Correspondence tracker | Java web application | $600K | 9 | 4 | 1 | 39 | 2 |
| S10 Public data API | Python in containers | $450K | 4 | 5 | 0 | 20 | 4 |
| Total | $11.1M | 32 |
POA&M counts only items that cannot close without a platform change. Risk is a 0 to 100 score: each factor is rated 1 to 5 and weighted 25 for staffing depth, 25 for end-of-support exposure, 20 for platform supportability, 20 for unclosable POA&M items and 10 for age. Mission criticality (1 to 5) is the value axis. A system scoring 60 or higher on risk and 3 or higher on criticality is a migrate candidate; high risk with low criticality is an eliminate candidate.
The three largest systems carry $6.9M of $11.1M, or 62% of portfolio O&M. That concentration is the first budget finding: the modernization decision that matters most to the CFO involves three systems, not ten.
| TIME quadrant | Systems | 7R pattern |
|---|---|---|
| Migrate (high value, poor condition) | S1, S2, S3 | Replace, refactor, replatform |
| Eliminate (low value, poor condition) | S4, S7, S8 | Retire |
| Invest (high value, sound condition) | S5, S6, S10 | Retain and keep current |
| Tolerate (low value, sound condition) | S9 | Retain as is; revisit at end of support |
26 of the 32 unclosable POA&M items sit on the six migrate and eliminate systems. Those are the items the ISSM can tie to a funded decision instead of carrying them as risk acceptances year after year. S3 runs on Windows Server 2016, so its replatform increment is sequenced first, since end of support arrives in January 2027.
| System | Decision | One-time cost | O&M now | Run cost after | Break-even (months) | At +50% cost |
|---|---|---|---|---|---|---|
| S4 Licensing portal | Retire | $260K | $900K | $120K | 4.0 | 6.0 |
| S7 Training records | Retire | $90K | $300K | $40K | 4.2 | 6.2 |
| S8 Facilities requests | Retire | $60K | $150K | $0K | 4.8 | 7.2 |
| S1 Grants management | Replace | $3.2M | $2.9M | $1.3M | 24.0 | 36.0 |
Break-even month is the one-time transition cost divided by the monthly run cost eliminated. The three retire candidates cost $410K to transition and remove $1.2M a year of net run cost; each pays back in under five months, and in under eight months even if transition costs run 50% over plan. The S1 replacement is a different kind of decision: about two years to break even, three years at the high case, which is why it needs a funding strategy and a capped parallel run, not just a business case. None of these figures is a promised saving. Savings are counted only in a decommission report after the system is actually off.
| Scope | Systems | Hours | Weeks at 60 hrs | Rate-band range | Planning fee |
|---|---|---|---|---|---|
| Small | 6 | 352 | 5.9 | $40.5K–$73.9K | $60K |
| Base | 10 | 480 | 8.0 | $55.2K–$100.8K | $78K |
| Large | 15 | 640 | 10.7 | $73.6K–$134.4K | $104K |
| KB ceiling | 25 | 960 | 16.0 | $110.4K–$201.6K | $156K |
Hours are 160 fixed (kickoff, data call, architecture outline, roadmap, funding strategy and readout) plus 32 per system: 8 for inventory and dependencies, 8 for interviews, 6 for scoring, 6 for the disposition summary and 4 for the authorization-impact note. The team works 60 hours a week at a blended $115 to $210 an hour. The ten-system base case is 480 hours over 8 weeks, $55.2K to $100.8K, quoted at $60K to $100K firm fixed price. The six-system case prices at the $60K floor of the band. The 25-system ceiling stays inside the price band but runs 16 weeks at this staffing, past the 12-week norm, so it needs a second named hire. Every case sits under the simplified acquisition threshold.
| Pitfall | How to avoid it |
|---|---|
| "While you're in there" scope creep | The disposition matrix becomes the contractual baseline; new asks go through change control |
| The decommission that never happens | Decommission is a dated deliverable with exit criteria and a capped parallel run |
| Data migration optimism | Profile real data during discovery and price migration on evidence |
| Assuming the ATO carries over | Authorization-impact note before every increment; the AO decides |
| Promising savings before the assessment | Break-even estimates only; savings verified after turn-off |
| Lift-and-shift called modernization | Rehost is one of seven patterns, chosen only when the rationale supports it |
A modernization that leaves the old system running has not happened. The work that changes a bureau's budget is a clear decision for every system, the authorization effect of each decision, a funding path, and an exit test written before anyone builds anything. Most bureaus can buy that decision quickly, inside a fixed price, before committing to a program.
The natural first step is the fixed-fee legacy disposition assessment: one bureau's unclassified portfolio, planned at about ten systems, about eight weeks of work, under the simplified acquisition threshold, ending in a scored inventory, a disposition matrix, authorization-impact notes, a funded roadmap and decommission criteria. To discuss a portfolio, contact Avalon Technology Services at contact@AvalonTechServices.com.
7R
Disposition patterns for a system: rehost, replatform, refactor, rearchitect, replace, retire, retain.
ATO
Authorization to operate: the Authorizing Official's decision to accept the risk of operating a system. It is not a certification and does not carry over to a new platform by default.
FedRAMP Certified
The 2026 FedRAMP designation for a cloud provider's offering, in classes A through D. It covers the offering only; the agency authorizes its own use.
Gartner TIME
A rationalization model: tolerate, invest, migrate or eliminate.
Strangler fig
Replacing a legacy system piece by piece behind a stable interface until the old system can be turned off.
TMF
Technology Modernization Fund: a central fund for agency modernization projects, generally repaid by the agency.
Working capital fund
An agency IT fund under the MGT Act that can carry modernization money across fiscal years.
All values are planning assumptions for one representative unclassified bureau portfolio. None is drawn from a specific agency, a real system or a completed engagement.
| Assumption | Value | Basis |
|---|---|---|
| Portfolio | 10 systems, $11.1M O&M a year, 32 unclosable POA&M items | Planning assumption |
| Risk weights | Staffing 25, end of support 25, platform 20, POA&M 20, age 10 | Agreed at kickoff in a real engagement |
| Transition costs | S1 $3.2M, S4 $260K, S7 $90K, S8 $60K | Planning assumption |
| Assessment hours | 160 fixed + 32 per system | Planning assumption |
| Team | Lead/PM 1.0 FTE, named architect 0.5 FTE, 60 hours a week | One engagement at a time |
| Rates | $115–$210 an hour blended | Market-norm band, unclassified |
| Price check | Base fee $78K | Inside the $60K–$250K band |
