Federal Modernization Workbook · Book 18
Book 18 — Application Modernization
A Portfolio, Not a Rewrite
Why modernizing thousands of legacy mission applications is a portfolio decision, not a rewrite: triage, the target reference architecture, moving the data off Db2 and Oracle, generative and agentic AI with sponsors, compliance by design, architecture governance, a runnable reference implementation, TOGAF and Zachman, and running the portfolio in waves
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book is new material; it replaces no earlier workbook pages. Every external claim was checked against a primary source between October 28 and November 2, 2026 and carries a note, and each chapter keeps its verification log in the repository. Product versions and support windows (Java, Spring Boot, Node.js, React, PostgreSQL) and the status of migration tools are stated as of those dates. The reference implementation in Chapter 08 is illustrative: its tests pass against a real PostgreSQL engine, but it has not been run against a real Db2 or Oracle database or in production.
b18-application-modernization-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
Reference implementation: a Spring Boot service over PostgreSQL, a React front end, a Db2/Oracle to PostgreSQL migration with row-count, checksum and aggregate validation, and an agentic AI pattern with a stub model, in the repository’s examples/app-modernization folder. Chapter 08 walks through it.
15-minute presentation (about 10 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Executive briefing (about 30 minutes live, 14 narrated): for the CIO, chief architect, portfolio owners, CISO, privacy officer and authorizing officials: the application as the unit of decision, triage, one target architecture, proving the data, AI with a sponsor, compliance by design and the decisions to make, on the Presentations page.
Technical deep dive (about 50 minutes live, 21 narrated): triage scoring, the target architecture, moving and proving the data, AI guardrails, controls and gates, the reference implementation, TOGAF and Zachman, and the waves, in modules on the Presentations page.
Most agencies run hundreds or thousands of mission applications, many of them written decades ago on mainframes, in COBOL, PL/SQL or early Java, against Db2 or Oracle databases, by people who have since retired. Each one works, after a fashion, and each one costs more to keep running every year. The temptation is a grand rewrite. It rarely ends well: the program runs years late, the old system keeps running beside it, and the knowledge buried in the old code is lost on the way. Book 18 treats application modernization as a portfolio problem instead. The unit of decision is the application. Each one gets a disposition (retire, retain, rehost, replatform, refactor or rebuild) from a scored triage that can be run across thousands of applications, not a study per system. The ones that change land on one target reference architecture, so the agency builds and authorizes a pattern once and reuses it. Their data moves with proof that nothing was lost. Generative and agentic AI join the architecture only with an identity and an accountable owner for every agent. And the whole portfolio runs under standards, patterns and review gates that produce the evidence federal compliance asks for, mapped to the TOGAF and Zachman frameworks architects already use, and delivered in waves.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why is application modernization a portfolio decision, not a rewrite? | 01 |
| What | Triage, the target reference architecture, moving the data, generative and agentic AI, and compliance by design | 02, 03, 04, 05, 06 |
| Who | Who governs the architecture: the review board, standards, patterns and gates | 07 |
| How | The reference implementation, the TOGAF and Zachman mapping, running the portfolio in waves, and the identity remediation work packages | 08, 09, 10 |
Appendix: A — Identity remediation work packages
Reading paths
- Executives, CIOs and portfolio owners (20 minutes): Chapters 01, 02 and 10.
- Enterprise and solution architects: Chapters 03, 07 and 09.
- Database and data teams: Chapter 04, with Book 06 when the target is SQL Server.
- AI and application teams: Chapters 05 and 08, with Book 17.
- ISSOs, privacy officers and authorizing officials: Chapter 06, with Book 14.
- Identity engineers fixing application findings: Chapter 02’s identity and access intake fields, Chapter 10’s identity remediation factory and Appendix A.
Where this book sits in the workbook
This is Book 18 of the Federal Modernization Workbook. The program’s phases and gates, which the waves in Chapter 10 follow, are in Book 01, Chapter 12; decision rights in Book 00, Chapter 07. The identity side of a SQL Server target, from Windows Authentication to Microsoft Entra ID and connection strings, is Book 06. The cloud boundary the target platform runs in is Book 10; change control and provenance Book 13; authorization, supply chain and privacy controls Book 14; and identities and owners for AI agents Book 17.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — A Portfolio, Not a Rewrite | Why application modernization in a federal agency is a portfolio decision made one application at a time: the scale of the legacy problem from GAO’s 2019 and 2025 reviews and the share of IT spending that goes to operations and maintenance, why big-bang rewrites fail and federal policy asks for useful segments instead, why the application is the unit of decision, and the four questions the rest of the book answers. |
| Chapter 02 — Triaging the Portfolio | How to give every application in a large federal portfolio a disposition: the six dispositions (retire, retain, rehost, replatform, refactor, rebuild) and where they come from in Gartner’s five options, AWS’s 7 Rs and the Microsoft Cloud Adoption Framework; the triage criteria of mission criticality, technical condition, data sensitivity, cost, skills and dependencies; an evidence map that records dependencies as typed, sourced and dated relationships; a scored rubric that triages thousands of applications without a study of each; and where capital planning and the Technology Modernization Fund fit. |
| Chapter 03 — The Target Reference Architecture | The one architecture the refactored and rebuilt applications are built on, with versions and support windows as of October 2026: Java 25 LTS and Spring Boot 4.1 for services, React 19 for front ends, Node.js LTS where it fits, API-first contracts in OpenAPI 3.2, OCI containers on Kubernetes, twelve-factor configuration, the strangler-fig pattern for incremental replacement, and NIST SP 800-204 and SP 800-190 as the federal security references; and, for applications that stay on premises, Microsoft Entra application proxy in place of Web Application Proxy and secure hybrid access partners for header-based, Kerberos and LDAP applications. |
| Chapter 04 — Moving the Data: Db2 and Oracle to PostgreSQL or SQL Server | How to move an application’s data off Db2 and Oracle to PostgreSQL or SQL Server: choosing the target engine, schema conversion (type mapping, sequences, stored procedures and packages) and the conversion tools as of October 2026, proving that nothing was lost with row counts, checksums and independent aggregate reconciliation, and the cut-over and coexistence choices, including change data capture and the risks of dual writes. |
| Chapter 05 — Generative and Agentic AI in the Architecture | Where generative and agentic AI fits in a modernized application (assistive features, retrieval-augmented generation, code modernization assistance and agents that call tools); a provider-neutral model interface; the guardrails an agent needs (an identity and sponsor, a tool allow-list, least privilege, human approval for actions that change records, a step limit and an audit trail); the Model Context Protocol as an example tool protocol; and the OWASP, NIST and CISA material that informs the design, with the federal rules left to Book 17. |
| Chapter 06 — Compliance by Design | How a modernized application meets federal compliance by building it into the target architecture and its pipeline: what Circular A-130 asks of the system development life cycle; the NIST SP 800-53 Rev. 5 (release 5.2.0) control families most touched by application work (SA, SR, AC, AU, CM, SC, SI and PT) and the evidence each produces; the SSDF (SP 800-218) after OMB M-26-05 rescinded the attestation mandate; privacy under the Privacy Act and section 208 privacy impact assessments; data governance under the Evidence Act and chief data officers; records management; Section 508 accessibility as a gate across design, build, test, deploy and operate, with WCAG, OMB M-24-08, accessible sign-in and recovery, forms and error messages, the vendor’s Accessibility Conformance Report and documented exceptions; and enterprise architecture, with authorization detail left to Book 14. |
| Chapter 07 — Who Governs the Architecture | Who decides what in an application modernization portfolio: the architecture review board and its decision rights, the approved-technology list, reference patterns and architecture decision records, the design review, code review and release gates, the Git and pipeline practice behind them, and how each gate leaves the evidence that SP 800-53, SP 800-218 and the agency’s authorizing official need. |
| Chapter 08 — The Reference Implementation | A small, runnable slice of the book’s target architecture in the repository’s examples/app-modernization folder: a Spring Boot REST service over PostgreSQL with an OpenAPI contract the build checks against the code, a React front end, a Db2/Oracle to PostgreSQL migration tool that proves the move with row counts, checksums and independent aggregates, and an AI agent with an identity, a sponsor, a tool allow-list and a step limit that can only propose changes a person approves; what its tests prove, and what they don’t. |
| Chapter 09 — Mapping the Work to TOGAF and Zachman | How the book’s portfolio method lines up with the two enterprise architecture frameworks agencies most often name: the TOGAF Standard, 10th Edition, and its Architecture Development Method phases, and the Zachman Framework version 3.0 and its six-by-six cells; a chapter-by-chapter and artifact-by-artifact mapping to each; and why the federal requirement behind both is OMB Circular A-130’s enterprise architecture and SP 800-53 PM-7, not a framework. |
| Chapter 10 — Running the Portfolio in Waves | How to run an application modernization portfolio over years: waves laid on the program’s phases and gates G0 to G5, a pilot wave, factory waves and a long tail; the modernization factory of platform team, patterns and reusable pipelines; the metrics that show progress; funding through the Technology Modernization Fund and IT working capital funds; and how to keep the triage current after the first pass. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 18: fix confirmed crosswalk errors (rule 7 override, dependency axis and scoring, cross-chapter pointers, decision rights) (#381); Book 18: fix inconsistency findings (triage record, sponsor, gates, roles, dates) (#440); Decisions fix pass for Books 13 to 19: Book 18 gates and roles, Db2 spelling, Book 15 approvers, Book 16 criteria, Book 17 roles, Book 13 drift mapping (#456); Db2 spelling: Downloads, home page, app-modernization example, Book 18 brief and verification (#458); Decks: match Books 04, 16 and 18 pages after the Nov 7 decisions passes (#460); Re-render five videos after the #460 deck wording changes (#461); and 6 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Section 508: accessibility gates in Books 18 and 16, notes in Books 04 and 15 (#314); Privacy for workforce identity: Book 03 Chapter 14, and privacy sections in six books (#317) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (5 merged changes since the book began) |