The risks associated with legacy systems include that they can be difficult and expensive to support, lack operational resilience for key government services, and be vulnerable to cyber-attack. This exposes government to what is likely to be an uncertain but high level of financial risk from potential operational and cyber-related incidents. Legacy systems need a significant level of resource to make more regular, incremental updates over time.20 Given there are so many legacy systems in government, we asked how long it will be before it becomes necessary to start replacing them.21 The Cabinet Office responded that it wants to focus on those systems that are high-risk, or which present an impediment to business transformation.22 This requires departments to have a plan for how to manage their legacy estate, including sufficient funding for maintenance.23