APRA
Retired the system it used to collect bank data
Australia's prudential regulator retired its legacy submission system after a routine test found vulnerabilities, instead of patching it.
All case studies
Decommissioning
10 case studies tagged decommissioning.
CISA
Ordered agencies to take management interfaces off the internet
Binding Operational Directive 23-02 makes federal agencies find and remove internet-reachable management interfaces on routers, switches and firewalls.
CISA / Microsoft
Turned the print spooler off
CISA and Microsoft told administrators to disable the Windows print spooler on domain controllers and on any server that does not print.
US Navy
Terminated 11 legacy systems and saved over USD 100 million
The Department of the Navy retired at least 11 obsolete financial systems and saved over $100 million, while GAO found the consolidation plans kept slipping.
Blue
Left Render and Aurora for two dedicated servers
A three-person team replaced a managed frontend platform and a managed database with dedicated servers, a five-line deploy file and an Ansible playbook.
GAO
Found 11 legacy systems, aged 23 to 60, still running
Eleven systems across ten agencies are most in need of modernization; seven run with known vulnerabilities and three of the ten flagged in 2019 had been modernized by 2025.
City of Austin
Counted 1,005 applications and retired more than 230
A rationalisation run across 47 city departments produced confirmed savings of $8.1 million a year and two intake gates for anything new.
Cook County
Put its 1970s mainframe read-only, then retired it
The county went read-only in March 2026 and expected full decommissioning by July, for a stated saving of $6.5 million a year.
Microsoft
Decommissioned 1.4 million unused Entra applications
The Secure Future Initiative cut unused Entra applications, stripped critical-privilege Graph permissions and completed the Azure Service Manager retirement.
CISA
Gave agencies eighteen months to retire end-of-support edge devices
Binding Operational Directive 26-02 requires agencies to inventory listed end-of-support devices, decommission those losing support within a year, and remove the rest.