# Government Websites Retain Drupal 7

A post cites 428 government websites still running Drupal 7, raising concerns that outdated content-management systems may be exposed to unpatched risks. The count is not corroborated in the signal, and no specific agencies or sites are identified. The post also notes that selecting a vendor and completing an upgrade could take six months or more, highlighting a potentially lengthy procurement and implementation lead time for agencies that need to modernize legacy web platforms.

- Procurement teams can use the cited count as a prompt to validate their own website inventory and assess whether legacy CMS upgrades are needed; the signal does not identify particular affected agencies.
- Agencies planning an upgrade should account for a potential six-month-or-longer vendor selection and implementation timeline when sequencing procurement and technical work.
- Contractors providing CMS modernization or related cybersecurity services may find opportunities if agencies confirm upgrade needs; the signal names no solicitation, vendor, contract value, or deadline.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Digital Infrastructure
**Published:** October 29, 2026

### Key Quotes
> I'm sure Drupal is just the tip of the iceberg, but are there other areas like this seemingly higher risk as they have no updates or patches?
> — Original poster

### Sources
- [Outdated tech in gov - 428 gov't sites still running Drupal 7](https://www.reddit.com/r/govtech/comments/1ximo2d/outdated_tech_in_gov_428_govt_sites_still_running) - reddit-govtech