There is no clear plan to replace or modernise legacy systems and data that are critical to service provision but are often old, unsupportable, vulnerable and a constraint on transformation. Legacy systems, some of which date back to the 1970s, are widespread across government, which relies on them for important services such as managing the UK’s borders and paying the State Pension. Many of these systems are stable and performing acceptably at reasonable cost, but others are high-risk, unreliable, contain security vulnerabilities, or frustrate business transformation. Despite this, departments have a limited understanding of their legacy estate and the centre of government does not have an ongoing process for assessing and understanding what cross-government legacy risk looks like. The Central Digital and Data Office (CDDO) is now testing how it can gather information on departmental legacy systems. The CDDO hopes to prioritise where departments most need to take remedial action using a risk-based model and to roll this out more widely at the start of 2022. This is encouraging and we look forward to seeing the centre and departments take concrete action to begin to address high-risk legacy systems next year. Recommendation: At the start of 2022 the CDDO should work with departments to map legacy systems across government to document what is there, why it exists and how critical it is. By the end of 2022 the CDDO should use this to produce a pipeline of legacy systems they have prioritised with milestones for action. This pipeline should be shared with the Committee.