What is the correct process for handling federal records when a legacy IT system is being decommissioned or shut down?

Decommissioning a legacy IT system is a high-risk moment for federal recordkeeping. Systems often hold the only copy of records, and shutting them down without a plan can lead to the unauthorized loss or destruction of information that must be retained. The goal is simple: no record leaves the system until its disposition is properly accounted for.

Start before the lights go out

Records work should begin well before a system is scheduled to go dark. Treat decommissioning as a managed records event, not an IT afterthought.

• Identify the records. Inventory what the system actually contains, including data, metadata, attachments, logs, and audit trails. Distinguish records from non-record material.
• Confirm the disposition authority. Map each record type to an approved retention schedule. Records that have not met their retention requirement cannot be destroyed simply because the system is being retired.
• Check for holds. Confirm whether any content is subject to a legal hold, litigation, FOIA request, audit, or investigation. Records under a hold must be preserved regardless of schedule.

Preserve, migrate, or transfer

Once obligations are known, choose a path for each category of record:

• Migrate records still needed for business or that are not yet eligible for destruction into a successor system or an approved repository, keeping the content readable and its context intact.
• Preserve records in a sustainable, non-proprietary format where possible, so they remain usable after the original software is gone. Capture the metadata needed to find, authenticate, and interpret them.
• Transfer permanent records to the appropriate archival authority on schedule.

Document and verify

Maintain a clear record of what was migrated, what was transferred, and what was destroyed under proper authority, along with dates and approvals. Validate that migrated content is complete and accessible before retiring the source. Only after disposition is fully documented should the legacy system and any residual media be sanitized or disposed of.

Throughout, coordinate among records, IT, legal, privacy, and program staff. A system shutdown is also a chance to retire genuine non-records and reduce future risk. For more foundational guidance, see the federal records topic hub.