Yes, COBOL is still used, and so are the mainframes it runs on. Federal agencies still depend on both for payroll, tax processing, contract payments, and other work that has to be right every time.

The harder question for most agency leaders isn't whether these systems still run. It's how long they can keep running safely, and what to do before that decision gets made for them.

What are mainframes and COBOL?

A mainframe is a large, highly reliable computer built to process huge volumes of transactions. COBOL, short for Common Business Oriented Language, is a programming language designed for business and administrative work. It dates back to the late 1950s. Many government mainframe applications are written in COBOL, and some also use assembly language, which is written much closer to the hardware.

Neither one is automatically a problem. Mainframes earned their place by being dependable. The trouble starts when the system, the language, and the people who understand them all age at the same time.

Is COBOL still used in government?

It is, and the Government Accountability Office (GAO) has the numbers. In its 2025 review, GAO asked 24 federal agencies to name the legacy systems most in need of modernization, then ranked the 69 systems they submitted. The 11 at the top of the list tell a clear story:

• 11 systems across 10 agencies. Together they cost roughly $754 million a year to operate and maintain, and they range from about 23 to 60 years old.
• 8 of 11 use legacy languages. GAO named COBOL and assembly language as examples.
• Both Treasury systems on the list run on COBOL and assembly. Both support tax processing.
• What they do. Payroll and personnel, defense contract payments, tax processing, and clinical and patient administration, among others.

State and local agencies often run similar systems, though the public data is less complete than the federal picture.

Why do agencies still run mainframe systems?

Because they work, and because replacing them is hard. These systems often hold decades of business rules, policy changes, and edge cases that were never written down anywhere else. Switching one off without understanding all of that is a good way to break payroll or stop payments.

Budgets are part of it too. GAO reports that agencies typically spend about 80 percent of their IT dollars on operating and maintaining what they already have, which leaves less room to fund the replacement.

What are the risks of leaving mainframe systems as they are?

GAO groups the consequences into a few categories, and they'll sound familiar to most CIOs:

• Skills. Fewer people know COBOL and assembly, and agencies may pay a premium for those who do. One Department of Defense system GAO reviewed is a good example. Officials said the average age of the developers and technical experts on its team is above 60, and that finding COBOL and assembly developers is difficult.
• Security. Seven of the 11 systems have known cybersecurity vulnerabilities that can't be fully fixed without modernization. Agencies are mitigating some of them, for example by isolating the system from other networks, but mitigation isn't the same as a fix.
• Zero Trust. Eight of the 11 systems can't implement the federal Zero Trust strategy without modernization. We cover this in more depth in The Zero Trust Bottleneck: Why Legacy Systems Are the Hardest Pillar to Fix.
• Cost and flexibility. Maintenance costs tend to climb over time, and older systems are harder to change when policy or mission needs change.

Why is mainframe modernization so hard to pull off?

It usually isn't a lack of will. It's a lack of a documented plan, funding, or both.

GAO found that only 3 of the 11 systems had fully documented modernization plans. Six had partial plans, and two had none. Looking back at its 2019 list of the 10 most critical systems, GAO reported that as of February 2025 agencies had completed three of the 10 modernizations.

The Defense Department system makes the point. Built in 1964, it was slated for retirement in 2002. That didn't happen, in part because the existing technology and architecture were hard to replace, and later funding requests lost out to other priorities. It still runs on COBOL and assembly today.

The lesson isn't that modernization is out of reach. Big, one-shot replacement efforts depend on everything going right at once, and legacy systems rarely cooperate.

What does mainframe modernization actually involve?

There isn't one path. Common options include:

• Keeping the system and stabilizing it
• Rehosting it on newer infrastructure with minimal code changes
• Replatforming or refactoring parts of it
• Translating COBOL to a modern language
• Rebuilding it
• Replacing it with a commercial product
• Retiring it altogether

The right choice depends on the system, the mission, the budget, and the risk the agency can accept. We'll walk through those tradeoffs in a follow-up post on rehosting, refactoring, and rewriting.

Automation is also changing what's practical. The Defense Department team above is running a proof of concept on tools that automate translation of its COBOL code base into a modern language. And AI can help teams read and document old code far faster than before, as long as engineers verify the results. We wrote about that discipline in AI-Driven Legacy Modernization: The Discipline Behind the Orchestration.

Where should an agency start?

Before choosing a technology, we'd start with these steps:

1. Take inventory. Know which systems exist, how old they are, what language they use, and what mission they support.
2. Understand what the system really does. Document the business rules, interfaces, and data flows, including the ones nobody remembers adding.
3. Write the plan down. GAO's baseline is simple: milestones, a description of the work, and what happens to the legacy system when it's done.
4. Plan in increments. Smaller, staged steps that deliver value along the way are easier to fund, easier to test, and easier to course-correct than a single large cutover.
5. Protect the knowledge. Capture what your remaining experts know while they're still available.

At The Canton Group, we've modernized legacy systems for government and enterprise clients since 1998, and the starting point is always the same: understand the system and the mission behind it before picking a path. Every environment is different, so the plan should be too. Our own in-house team does that work, from first assessment through delivery.

Frequently Asked Questions

Thinking through a mainframe or COBOL system and not sure where to start? Contact The Canton Group. We're glad to talk through your situation and your options.