The Central Digital and Data Office (CDDO), in the Cabinet Office, has established a programme to support departments managing legacy IT. CDDO has agreed a frame-work to identify ‘red-rated’ systems, indicating high levels of risk surrounding certain assets within the IT estate. Departments have committed to have remediation plans in place for these systems by next year (2025). It is not appropriate to release sensitive information held about specific red-rated systems or more detailed plans for remediation within Defra’s IT estate, as this information could indicate which systems are at risk and may highlight potential security vulnerabilities.