Upgrade or Decommission

• Factors influencing the decision to upgrade or replace software
• Measures to implement when upgrading software

Factors influencing the decision to upgrade or replace software

Software may need to be upgraded when it starts impacting efficiency, productivity, scalability, security, user experience or compatibility with modern technology. Some of the factors that may result in the need to upgrade software include:

• No longer meeting institution’s requirements: Software may need to be upgraded when its capabilities no longer meet the evolving needs and requirements of the organization and it may be more costly to enhance the existing system or it may not be technically feasible.
• Technology trends: If the software does not support current industry trends it may need to be upgraded. Examples can include incompatibility or inability to integrate with newer hardware or software systems. In addition newer versions of software may have features and capabilities not supported by the existing software.
• Challenges with performance and scalability: If the system has persistent challenges with performance that impact the experience of its users. These are performance issues with the software that are not related to underlying infrastructure and that cannot be easily resolved.  This can also be the case if the software is not scalable to the growing needs of the institution.
• End of support: Software provided by external vendors may reach its end of life or end of support. This means the software is no longer supported by the vendor and critical updates such as software enhancements and security patches are no longer available. This would pose a risk to the institution and institutions need to monitor end of life dates and plan for upgrades in advance.
• Cost/ benefit analysis: when the cost of maintaining the system exceed the benefits and upgrading provides a better cost/benefit outcome in the longer term.

Measures to implement when upgrading software

The following should be considered when upgrading software to minimize the risks involved in the process such as data loss or security risk.

• Impact analysis [Mandatory] - Conduct an analysis to fully understand the impact of decommissioning the software. This includes an understanding of impact to operations of the institution and users as well as cataloging all internal and external systems and interfaces that integrate with the current system. Risks and mitigations should also be identified and document.
• Secure the data[Mandatory] - Data should be secured from loss or unauthorized exposure. The institution should determine what data needs to be migrated to new systems or archived based on the institution's data retention requirements as well any legal requirements. This should be documented as part of the data migration strategy. Data should be securely backed up prior to decommissioning of the software and any data being migrated should be protected from unauthorized access. Hardware should also be properly cleansed of the old software and any sensitive data.
• Software archival [Mandatory] - Consider if the software needs to be archived for future reference. If required, the software being replaced should be secured by copying the software to a secure location so that it can be accessed if needed in the future. This should be done in accordance with any license or IP requirements.
• Stakeholder communication [Mandatory] - All relevant stakeholders such as user departments and IT teams should be involved in the decision to replace the software and should be informed of the transition plans. They should also be informed of how their data will be managed and retained during the transition process.
• Documentation update [Mandatory]- Any documents in the organization referring to the replaced software such as policies and procedures should be updated accordingly.

Outputs: Business case/justification for upgrading or replacing the software, Impact analysis including risks and mitigations, Data migration strategy covering data security controls, data migration and archival plans, Stakeholder communication plan, Archived software and data