Scenario: A Government Agency Moving from Drupal 7 to Next.js

A modeled scenario based on published federal IT data and Drupal's actual EOL timeline.

Key finding

Drupal 7 EOL: January 2025 (Source: drupal.org official announcement. Extended to November 2023, then January 2025.)

This is a modeled scenario, not a specific agency's story. The Drupal 7 EOL date and federal IT spending figures are real. The migration costs are modeled from published government IT contracting rates.

The Context

Drupal 7 reached end of life in January 2025 after multiple extensions. Organizations still running it must either pay for third-party extended security support or migrate. This is not hypothetical — it's the situation thousands of organizations face right now.

January 2025

Drupal 7 EOL

Source: drupal.org official announcement. Extended to November 2023, then January 2025.

$100B+ annually

US federal IT legacy spending

Source: GAO reports on federal IT spending. Over 80% goes to operations and maintenance.

1,374

Drupal CVEs in NVD

Source: Our NVD collection. Verified against services.nvd.nist.gov.

Modeled Migration

Government IT projects follow FAR procurement rules, which typically add 40-60% overhead to equivalent private sector costs. Published GSA Schedule rates for web development range from $125-250/hr.

$125 - $250/hr

GSA Schedule web dev rate

Source: GSA Advantage published schedule pricing.

The Security Dimension

CISA's Known Exploited Vulnerabilities catalog includes Drupal entries. Federal agencies are required by Binding Operational Directive 22-01 to remediate KEV entries within defined timelines. Running EOL software makes compliance structurally impossible.

14 days (critical)

CISA BOD 22-01 remediation timeline

Source: CISA Binding Operational Directive 22-01, published November 2021.

Data Sources

Drupal EOL: drupal.org. Federal IT spending: GAO-23-106821. CISA BOD: cisa.gov/bod-22-01. CVE data: NIST NVD via WebPulse collection. GSA rates: gsaadvantage.gov.