The NAO also found that Defra did not expect to resolve all its legacy issues until 2030.15 For example, Defra told us that it had worked with the Central Digital & Data Office (CDDO) to establish which services were most critical or had the largest number of users. It explained that, of the top 75 public-facing applications identified using this classification, 12 were within Defra.16 In January 2023, Defra told us that, of Defra’s 12 systems with the highest volume of public or business users, two were a mixture of modern and legacy systems and one was an entirely legacy system.17 However, across Defra’s applications as a whole, only 20% were fully supported by the original supplier. 50% of the applications had at least one part that was in extended support and the remaining 30% were unsupported by the original supplier, reduced from 50% in September 2019.18 Defra recognised that the legacy applications which were unsupported by the original supplier were more at risk of security breaches or operational failure.19 Defra told us that it had put in place “hyper-care” to support these applications, including additional routine monitoring of these services so that it was “more acutely aware if there is an issue”.20 It explained that it supported these applications either through its internal digital team or by paying suppliers to help if something went wrong. Defra told us that, while it was less confident that these services were providing the best service for the customer, it was confident that it had identified the applications that were most at risk and had put the right care in place to prevent the risk of cyber-attack or the systems failing.21