This is a modeled scenario, not a specific agency's story. The Drupal 7 EOL date and federal IT spending figures are real. The migration costs are modeled from published government IT contracting rates.
The Context
Drupal 7 reached end of life in January 2025 after multiple extensions. Organizations still running it must either pay for third-party extended security support or migrate. This is not hypothetical — it's the situation thousands of organizations face right now.
Modeled Migration
Government IT projects follow FAR procurement rules, which typically add 40-60% overhead to equivalent private sector costs. Published GSA Schedule rates for web development range from $125-250/hr.
The Security Dimension
CISA's Known Exploited Vulnerabilities catalog includes Drupal entries. Federal agencies are required by Binding Operational Directive 22-01 to remediate KEV entries within defined timelines. Running EOL software makes compliance structurally impossible.
Data Sources
Drupal EOL: drupal.org. Federal IT spending: GAO-23-106821. CISA BOD: cisa.gov/bod-22-01. CVE data: NIST NVD via WebPulse collection. GSA rates: gsaadvantage.gov.
