In most cases, yes, you can modernize a mainframe without disrupting operations, but not by replacing everything at once.
The agencies that keep services running tend to change the system in small, reversible steps, with the old and new systems side by side until the new one has proven itself. That takes more planning up front and some temporary scaffolding, but it keeps the mission running while the work happens.
This is the fourth post in our mainframe modernization series. If you're just joining, the earlier posts cover why COBOL and mainframes are still in use, how to choose an approach, and why understanding the system comes first.
What does "without disrupting operations" mean?
It's worth defining, because it means different things to different teams. In practice it usually covers four commitments:
A good plan spells out what "no disruption" means for each of these, and what exceptions are acceptable.
What techniques keep services running during modernization?
There's no single method, but these show up repeatedly:
Routing through a façade (the "strangler fig" pattern). A routing layer sits in front of the legacy system and sends each request either to the old system or to a new component. As functionality is rebuilt, more traffic moves to the new side, until the old system has nothing left to do and can be retired. Both Martin Fowler, who popularized the name, and Microsoft's architecture guidance describe it as a way to replace a legacy system gradually and reduce the risk of one large change.
API enablement. Specific functions of the mainframe are exposed through modern interfaces, often called APIs, so that new portals and applications can use them without touching the core system. This can improve the user experience quickly. But it doesn't remove the underlying issues of cost, skills, or security on the old platform, so it works best as a steppingstone, not a destination.
Data synchronization. While old and new systems run together, their data must stay consistent. Shared data stores are one of the harder parts of this work, and Microsoft's guidance specifically flags them as something to plan for.
Parallel runs. The old and new systems process the same real inputs, and the results are compared before anyone relies on the new one. This is where the test baseline we described in the third post pays off.
Phased cutover with a rollback plan. Functions or user groups move over in stages, and the team knows in advance how to go back if something goes wrong.
Are there federal examples of phased modernization?
Yes. GAO's 2025 report on critical legacy systems describes a few, and the dates below reflect the plans at the time of that report:
- The Department of Energy is migrating several functions that depend on a legacy human capital system to a new platform, with that migration scheduled to finish by December 2026. Only afterward does the department plan a formal modernization effort for the remaining functions and dependent systems.
- The Department of Commerce is rolling out a replacement for a legacy financial management system one bureau at a time: NOAA in October 2023, the Census Bureau planned for 2025, and NIST planned for 2026. Phasing it this way meant each bureau could move on its own schedule.
The Commerce example also carries a caution, which we'll get to below.
How does security work during the transition?
This is where legacy systems get hard, and where timing matters. GAO found that seven of the 11 most critical federal legacy systems it reviewed have known cybersecurity vulnerabilities that can't be remediated without modernization, and eight can't implement the federal Zero Trust strategy without it. Some agencies reduce the exposure in the meantime, for example by isolating the system from other networks. That helps, but as we've said before, mitigation isn't the same as a fix.
A phased approach can help here too. New components can be built to current security standards and placed in front of or alongside the older system, so more of the work moves under modern controls as each phase completes. The federal National Cybersecurity Strategy has called for removing legacy systems that can't support Zero Trust within a decade or otherwise mitigating the risk of those that can't be replaced in that time. We cover why this is so difficult in The Zero Trust Bottleneck: Why Legacy Systems Are the Hardest Pillar to Fix.
What are the trade-offs of an incremental approach?
It lowers risk, but it doesn't make the work easy, and it's worth going in with eyes open:
- You build scaffolding that you later throw away. Fowler notes that people often balk at the transitional architecture needed to let old and new systems coexist, since that code goes away once the work is finished. It's usually still worth it, but it's real effort.
- You run two worlds for a while. That means more to monitor, more to keep in sync, and more to explain to staff.
- Timelines can stretch. The Commerce effort began around 2009, was paused for five years, and saw its NOAA deployment arrive a year later than planned. Phasing reduces risk, but it doesn't guarantee speed.
- Don't count on savings alone. GAO reported in December 2023 that 24 projects funded through the federal Technology Modernization Fund anticipated about $756 million in cost savings, but only about $14.8 million, from eight projects, had been realized at that point. Those weren't all mainframe projects, but it's a fair reminder to plan carefully when savings are part of the case.
Why does the people side matter so much?
Because a technical cutover can go perfectly and still fail if users aren't ready for it. Training, communication, and support at each phase are part of the plan, not an afterthought. Our team includes organizational change management practitioners, and in our experience the projects that run smoothly are the ones that treat this work as seriously as the code.
Where do automation and AI help?
Mostly in the heavy, repetitive middle of the work. AI tools can help map dependencies, translate code, generate test cases from real production data, and produce documentation much faster than teams could by hand. As with everything in this series, engineers and program experts still need to verify the results. We describe that discipline in AI-Driven Legacy Modernization: The Discipline Behind the Orchestration.
What questions should leaders ask before starting?
- Which services can never go down, and when are our busiest periods? For example, a payroll system has very different tolerance for change in the days before payday than in the middle of a pay cycle. (This is just an example, not a specific case.)
- How will we prove the new system gives the same results as the old one?
- How will we roll back, and who decides?
- How will data stay consistent while both systems run?
- What's our security plan for the transition period?
- What training and support will staff get at each stage?
At The Canton Group, we've modernized legacy systems for government and enterprise clients since 1998, and we plan around the client's operations, not the other way around. Our in-house team tailors the approach to each environment, because the right phasing for one agency is rarely right for another.
Frequently Asked Questions
Can you modernize a mainframe with no downtime?
Often you can keep services available throughout by moving functionality in stages and running old and new systems together until the new one is proven. Brief planned maintenance windows may still be needed at certain points.
What is the strangler fig pattern?
It's an incremental approach in which a routing layer sends requests to either the legacy system or new components. As functions are rebuilt, more traffic moves to the new side, and the old system is eventually retired.
What does it mean to wrap a mainframe with APIs?
It means exposing specific mainframe functions through modern interfaces so other applications can use them without changing the core system. It's useful as an interim step, but it doesn't remove the legacy platform's underlying cost, skills, or security limitations.
Running the old and new systems on the same real inputs and comparing the results before the new system takes over.
Can agencies improve security before they finish modernizing?
Partly. Isolation, access controls, and modern components placed in front of legacy systems can reduce exposure, though GAO notes that some vulnerabilities can't be fully remediated without modernization.
How long does a phased modernization take?
It varies widely. Federal examples run from a few years to well over a decade, depending on scope, funding, and complexity.
Planning a mainframe modernization and worried about keeping services running? Contact The Canton Group. We're happy to talk through your systems, your constraints, and what a phased plan could look like.
