This article is based on reporting originally published by gcn.com, drawing on remarks made at MeriTalk’s Cloud Computing Brainstorm event held on June 7, 2017, in Washington, D.C.
Modernizing Without Disruption: A Federal Challenge
Federal agencies face a uniquely demanding IT challenge: their systems must remain fully operational even while being modernized. Judges need access to case management systems, ATF agents rely on bomb tracking databases, and crop insurers depend on risk management platforms — all day, every day. Downtime is not an option, yet the underlying technology continues to age.
At a June 2017 event in Washington, D.C., senior IT officials from three U.S. federal agencies — the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the Administrative Office of the U.S. Courts, and the Department of Agriculture’s Risk Management Agency (USDA RMA) — shared how DevOps practices are helping them manage that tension between availability and modernization.
Prioritizing Quick Wins to Build Momentum
Lionel Cares, ATF Data Services Branch Chief, emphasized the importance of identifying systems that are relatively easy to migrate or modernize first. Rather than attempting a sweeping transformation, ATF’s approach focuses on creating seamless transitions by targeting workloads that can be moved with the least disruption.
“The IT side of the house needs to decide what the quickest wins are because we want to create seamless transitions. We are looking at those systems that are easily movable and easier to leverage.”
— Lionel Cares, ATF Data Services Branch Chief
This incremental approach — sometimes called a “strangler fig” modernization pattern — allows agencies to demonstrate value early, secure continued investment, and avoid the organizational paralysis that comes with large-scale, all-or-nothing projects.
DevOps as a Tool for Surfacing Technical Debt
Peter Chin, Chief of Application Development and Architecture at the Administrative Office of the U.S. Courts, highlighted an often-overlooked benefit of adopting DevOps: improved system visibility. When automated testing and monitoring pipelines are introduced, teams gain a clearer picture of system health than they ever had with manual processes.
“One of the benefits of DevOps that we realized as we were doing automated tests and monitoring was the ability to see more clearly the health of the system. We are able to identify the technical debt that has accumulated over the years, whether it comes from security patches or the stability of the technology that we have been using.”
— Peter Chin, Chief of Application Development and Architecture, Administrative Office of the U.S. Courts
This is a meaningful insight for any organization modernizing legacy infrastructure. Automated pipelines create feedback loops that make long-ignored problems — outdated dependencies, missing security patches, fragile integrations — visible and measurable for the first time. You cannot fix what you cannot see.
Legacy Systems: The Aircraft Carrier Problem
Chad Sheridan, CIO of the USDA’s Risk Management Agency, offered a frank assessment of the pace constraints that legacy systems impose. DevOps adoption in environments built on decades-old platforms requires careful sequencing and executive patience.
“You need to prioritize where you are going and how fast you plan to go because you can’t move an aircraft carrier overnight. I have to make a case to modernize all of our platforms, not just to deliver the new shiny, or we are never going to get to this environment.”
— Chad Sheridan, CIO, USDA Risk Management Agency
Sheridan’s point about not just chasing “the new shiny” is worth emphasizing. A common pitfall in DevOps transformation programs is investing heavily in greenfield projects while leaving the legacy core untouched. Technical debt in the legacy portfolio compounds over time and eventually becomes a blocker to the very agility DevOps is meant to deliver.
Security Incidents as a Catalyst for Change
Sheridan noted that high-profile breaches — including the 2015 Office of Personnel Management (OPM) data breach and the 2014 Sony Pictures hack — provided a concrete business case for accelerating DevOps and infrastructure modernization at USDA RMA.
“We took advantage of our friends at OPM, Sony and others to show there was a business risk inherent in how we were operating before. The fertile middle of our portfolio is where we are seeing the real progress, but we found that we need to tackle some of the technical debt as well.”
— Chad Sheridan, CIO, USDA Risk Management Agency
This reflects a pattern common in both public and private sector organizations: security incidents, especially ones that receive media and congressional attention, unlock budget and political will for modernization initiatives that previously could not gain traction. The key is using that momentum to address systemic problems — not just the most visible ones.
Learning From False Starts
Both Sheridan and Chin acknowledged that their DevOps journeys included false starts and missteps. Crucially, neither viewed these as reasons to abandon the approach. Instead, the U.S. Courts’ experience led to a deliberate recalibration of pace and scope.
“At the U.S. Courts, we really sped up quickly from the beginning, and now we are slowing down to make sure that we have successes team by team rather than as a whole. We are working to figure out what problems we are trying to solve, baselining where we are today, determining metrics to improve and figuring out ways to continuously measure what we are trying to do with integration and deployment.”
— Peter Chin, Chief of Application Development and Architecture, Administrative Office of the U.S. Courts
This is a mature and honest reflection on DevOps adoption. Moving too fast without establishing baselines and success metrics is a common failure mode. Slowing down to instrument, measure, and validate at the team level — before scaling organization-wide — is often the more sustainable path.
Key Takeaways for DevOps in Legacy Environments
- Start with quick wins. Identify systems that can be moved or modernized with minimal risk to establish credibility and build momentum.
- Use automation to reveal hidden problems. Automated testing and monitoring expose technical debt that manual processes obscure.
- Plan for the full portfolio, not just new projects. Ignoring legacy systems while modernizing new ones creates a growing liability.
- Set a realistic pace. Large, complex environments cannot be transformed overnight. Sequence changes carefully and communicate timelines honestly to stakeholders.
- Baseline before you optimize. Define what success looks like, measure where you are today, and track change over time with meaningful metrics.
- Treat false starts as learning opportunities. Expect some plans to need revision. What matters is that teams are able to course-correct without abandoning the overall direction.
The experiences shared by ATF, the U.S. Courts, and USDA RMA illustrate that DevOps adoption in complex, mission-critical environments is neither fast nor linear — but the discipline it introduces around automation, measurement, and continuous improvement is precisely what makes large-scale IT modernization tractable.