The Compliance Trap: Legacy System Compliance Without Surrendering Your Data Sovereignty

On October 23, a ransomware crew listed J.B. Hunt on its leak site. The company told reporters it was investigating a cybersecurity incident involving unauthorized access to certain information. Four proposed class actions were filed within a week. Comparitech counted 61 ransomware attacks on transportation companies in October, up 126% from each of the two months before. If you run a warehouse, a fleet, or the systems behind them, legacy system compliance just stopped being a paperwork topic. It is now a patch cadence topic, an evidence topic, and a contract topic.

That is the trap. The old system cannot be patched fast enough to satisfy the rules. The fastest way out looks like a rented platform that promises "compliance included." Take that door and you hand your data, your business rules, and your audit trail to someone else's roadmap and renewal price. There is a third door. This article walks through all three, with the sources behind each claim.

Why legacy system compliance now fails on the patch clock

Verizon's 2026 Data Breach Investigations Report put a number on the shift. Nearly a third of breaches, 31%, now begin with vulnerability exploitation. For the first time in the report's 19 years, that beat stolen credentials as the biggest point of entry. Breaches involving a third party jumped 60% and now make up nearly half of the total.

The defenders' side of the ledger moved the wrong way. The median time to fully patch a vulnerability rose to 43 days, up from 32 the year before. Only 26% of the vulnerabilities on CISA's Known Exploited Vulnerabilities list were fully remediated in 2025. The prior year it was 38%.

Hold those numbers next to the federal benchmark. On June 10, 2026, CISA replaced its old two-week rule with Binding Operational Directive 26-04. A listed vulnerability that hands an attacker total control of a system must be fixed in three days. Most other listed vulnerabilities get 14 days. Lower-risk combinations get 60. CISA says plainly that it wants private organizations to adopt the same matrix, and auditors and cyber insurers are already borrowing it. A 43-day median is three times the standard window.

None of this is a people problem. It is a seam problem. Legacy systems resist a modern patch cadence for structural reasons:

• Business logic is welded to one operating system build or one database version. Patching the platform means retesting everything, and there is no test harness.
• The system runs on a single box nobody dares reboot during a shift.
• The vendor ships fixes quarterly, so the KEV clock and the release clock never line up.
• Logs stay on the machine. Nothing forwards them. When an incident happens, the timeline has to be rebuilt by hand.
• The person who understood the integration moved on. The seam stayed.

Federal agencies show how far that drifts. In July 2025 the GAO reviewed the 11 most critical legacy systems across 10 agencies. Seven of them ran with known cybersecurity vulnerabilities, eight used outdated languages, and four sat on unsupported hardware or software. Agencies report that about 80% of federal IT spending goes to operating and maintaining what already exists. Mid-market firms rarely publish that ratio. The ones we visit would recognize it.

The calendar keeps adding pressure. Windows 10, Exchange Server 2016 and Exchange Server 2019 all left support on October 14, 2025. StatCounter still counted more than one in four Windows desktops worldwide on Windows 10 this fall. SQL Server 2016, the database under many mid-market WMS and ERP installs, reached the end of extended support on July 14, 2026. Windows Server 2016 follows on January 12, 2027. Paid extended security updates buy a year or three. They do not buy a test harness, log forwarding, or an export format.

The rules now want evidence, not intentions

The European Union's Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since January 17, 2025. It is written for banks, insurers, payment firms and investment firms. It reaches everyone who serves them. The five pillars are:

1. An ICT risk management framework, with the management body accountable (Articles 5 to 16).
2. Incident classification and reporting (Articles 17 to 23).
3. Resilience testing, including threat-led penetration testing (Articles 24 to 27).
4. Third-party risk: a register of every ICT arrangement, exit strategies, and contract terms covering data access, return and deletion, audit rights and termination (Articles 28 to 30).
5. Direct oversight of critical ICT third-party providers (Articles 31 to 44).

The incident clock is tight. The reporting standard, Delegated Regulation (EU) 2025/301, sets the pace. A financial entity sends an initial notification within four hours of classifying an incident as major. It must arrive no later than 24 hours after the entity becomes aware of it. An intermediate report follows within 72 hours. A final report is due within a month.

The first published national fine under DORA landed on July 14, 2026. Austria's financial regulator sanctioned Western Union International Bank for repeated breaches of Article 19(4), after several delayed initial and intermediate incident reports. Read that again. The penalty was not for being breached. It was for reporting late. That is an instrumentation failure, and it is exactly what a legacy system with local-only logs produces.

In November 2025 the European supervisory authorities named the first 19 critical ICT third-party providers. Amazon Web Services, Microsoft, Google Cloud, Oracle, IBM and SAP are on the list. If your platform runs on one of them, your EU customers now have a regulator looking over the same shoulder.

A Houston 3PL does not need an EU banking license to feel this. In August, a cyberattack disrupted eight Ceva Logistics warehouses in Europe. The Dutch data protection authority opened an investigation. One retail customer suspended all data exchanges with the provider until it could confirm they were safe. That is how the obligations travel: down the contract, from the regulated customer to the warehouse that holds their data.

Expect the next master services agreement from a regulated customer to ask for the Article 30 list, whatever country it comes from:

• A full description of the functions and data you handle for them.
• Where the data is processed and stored, and notice before that changes.
• Incident notification on their clock, not yours.
• Audit and inspection rights, including for their regulator.
• Cooperation with their resilience testing.
• Exit assistance, and return of their data in a usable format at termination.

The US calendar runs on the same logic, even where deadlines moved:

• Public companies disclose a material cyber incident on Form 8-K within four business days of deciding it is material.
• The FTC Safeguards Rule requires covered financial institutions to notify the FTC within 30 days of a breach affecting 500 or more consumers.
• The Texas Data Privacy and Security Act has applied since July 1, 2024, and the Texas Responsible Artificial Intelligence Governance Act since January 1, 2026.
• CIRCIA's final rule went to White House review in October 2026, with 72-hour incident and 24-hour ransom-payment reporting proposed for critical infrastructure, a category that includes transportation.
• CMMC Phase 2 was suspended on July 13, 2026, but DFARS 252.204-7012 and NIST SP 800-171 still bind defense suppliers in full.
• The HIPAA Security Rule rewrite slipped to a 2027 target. The FDA food traceability rule now carries a July 20, 2028 enforcement date.

Every one of those is an evidence deadline. Each asks the same questions. What happened, when did you know, what did it touch, and can you prove it? A delay is a planning window, not a reprieve.

The second door: rented compliance and the lock-in trap

Here is where the trap closes. A platform vendor reads the same news you do. The pitch writes itself. Move everything onto our cloud platform. We patch it. We log it. Compliance is included.

Part of that is true. A well-run multi-tenant platform does patch faster than a single server in a warehouse office. What the pitch leaves out is what you give up to get it.

Your data moves into their schema. Your business rules, the ones your operation spent a decade refining, become configuration in their product. Your audit trail becomes their report. Export means a CSV, if the plan tier allows it. The renewal price resets on their schedule, not yours. Vertice's SaaS inflation index hit a record 16.4% in June 2026 and was still running at 14.3% in early September data.

Regulators have stopped treating this as a customer failing. The UK Competition and Markets Authority's cloud market investigation flagged data egress fees, interoperability gaps and software licensing as barriers to switching. On March 31, 2026 the CMA accepted commitments from AWS and Microsoft to lower egress fees and improve interoperability, and signalled a separate investigation into Microsoft's business software licensing.

The EU went further. The Data Act, Regulation (EU) 2023/2854, has applied since September 12, 2025. Article 25 caps the switching transition at 30 days in the normal case. Article 23 orders providers to remove the commercial, technical and contractual obstacles that stop customers leaving. Article 29 bans switching charges, including data egress charges, from January 12, 2027. Lawmakers wrote those articles because the obstacles were real and structural.

That leads to the question the word "sovereignty" is really asking. Data sovereignty is not a flag on a map. It is four plain tests:

• Who can read the data, and under whose law?
• Where do the business rules live, and can you run them without the vendor?
• Can you leave with everything, in a format another system can load?
• After you leave, can you still reproduce the audit evidence you filed last year?

A rented platform answers the first question with a data residency checkbox. It rarely answers the other three. The residency checkbox has limits of its own. A platform run by a US provider can be subject to lawful US requests wherever the server sits. That is why European customers keep asking where the keys are held, not only where the disks are.

And the rented door adds a dependency the rules now measure. Your incident clock runs on the vendor's disclosure clock. Verizon's finding that third-party involvement now touches nearly half of breaches is the cost of that dependency, counted.

The third door: keep the platform, own the layer

The way out is neither door. Keep the platform where it is good. Move the parts the rules care about into software you own, running beside it. Martin Fowler named the pattern the strangler fig more than twenty years ago. Microsoft's architecture guidance pairs it with an anti-corruption layer that translates between the old system's model and the new one. The old system stays in service. Function by function, the owned layer takes the weight.

Done in the right order, this fixes the patch problem and the evidence problem without the lock-in problem:

• Instrument first. Forward logs and events from the legacy system into a store you control, in the open OpenTelemetry formats. The four-hour and 72-hour reports stop being archaeology.
• Inventory second. Build the software bill of materials and map it to CISA's KEV list. Now the three-day and 14-day clocks have a list to run against.
• Isolate what cannot be patched. NIST SP 800-40 Rev. 4 treats patching as preventive maintenance. It also says plainly that some assets cannot be patched and must be isolated, mitigated or replaced. Network segmentation and a read-only replica buy time without pretending.
• Move the regulated functions into the owned layer. Audit evidence, access control, integrations and customer-facing portals. Each one ships with a documented export format.
• Govern the suppliers. NIST's Cybersecurity Framework 2.0 added a Govern function for exactly this. Your register of ICT arrangements and your exit plans live there.

Software in this layer frees people for judgment. It does not replace them. The supervisor still decides the exception. The system makes sure the exception is recorded, timed and attributed.

We built one of these layers for a warehouse that owed quality results to its end customer under contract. The evidence lived on paper forms and a general-purpose survey tool that could not report across responses. The audit and compliance platform we delivered changed the shape of the evidence. Each audit form is configuration, not code, so the client adds one without a developer. The outbound audit compares every scan with the order. A mismatch blocks submission and emails leadership. Only a manager who signs in again and types a reason can override it. A monthly housekeeping audit enforces its one hard rule in code: nobody audits their own area. Reports that paper could never answer now come from the same records. The WMS underneath was never replaced.

That is what instrumentation looks like from the floor. Nobody has to remember to write it down. The record exists because the work happened.

What "100% you own the code" has to mean on paper

Our guarantee is simple to say. You own 100% of the code outright, delivered at a fixed price, quoted up front. Simple to say is not the same as automatic in law, so here is what the sentence has to carry.

US copyright law does not hand a client the software it paid a contractor to write. The Copyright Office's Circular 30 sets two conditions for a commissioned work to count as a work made for hire. It must fall into one of nine listed categories. Both parties must also sign a written agreement saying so. Custom software rarely fits those categories cleanly. Under 17 U.S.C. 204(a), a transfer of copyright has to be in a signed writing. Without a signed assignment, a vendor's "you own it" is a promise with no paper under it.

Ownership on paper means a package, not a repo link:

1. A signed assignment of copyright covering the code, the documentation and derivatives.
2. Source repositories in your own organization account, with the vendor added as a member you can remove.
3. Build and deploy pipelines and infrastructure definitions in accounts you control.
4. Hosting, cloud, DNS and domain registrations in your company's name.
5. A secrets vault you own, with every credential rotated at handover.
6. Database access and a documented, tested export format for every table that holds regulated data.
7. Architecture notes and runbooks a second developer could work from.
8. A third-party and open-source license inventory, which is the same bill of materials the KEV mapping needs.
9. An escrow agreement with defined release conditions for any component the vendor keeps proprietary. In our engagements that list is empty.

CISA's Secure by Demand guide gives software buyers a short list of questions on patching, logging, authentication and bills of materials. Ask them of every vendor, including us. A vendor who cannot answer them cannot support your incident report either.

Compare that package with the three ways software is usually sold. A SaaS subscription grants access while you pay. A perpetual license grants the right to run one version, usually with no source. Owned source with a signed assignment grants the right to change it, re-host it and hand it to another developer. Only the last one survives a vendor's bad year, a price reset, or an acquisition.

A modernization sequence that keeps you in control

Here is the sequence we run, with the clocks it serves. Each phase leaves the operation better protected even if the next one never starts.

Phase 0, weeks one and two: see it. Inventory every system that holds regulated data. Forward its logs. Map its components to the KEV list. Write down who owns each account and each domain. Output: an incident timeline you can produce in hours, not days.

Phase 1, the first quarter: wrap it. Put an anti-corruption layer and an API facade in front of the legacy system. Stand up a read-only replica for reporting. Segment the network so an unpatched box cannot reach what it does not need. Output: a patched perimeter around an unpatched core.

Phase 2, the next two to three quarters: strangle it. Move one regulated function at a time into the owned layer. Audit evidence first, because it has the hardest clock. Then access control, then integrations, then portals. Every function ships with an export format and a restore test. Output: evidence and rules you can take anywhere.

Phase 3, when the business is ready: retire or re-platform the core. By now the core holds less. Replace it, upgrade it in place, or move it to a vendor platform on your terms. The owned layer stays. The exit plan already works, because you have been rehearsing it.

Two habits keep the sequence honest. Patch cadence: KEV-listed items inside 14 days, three days when the flaw gives total control, and everything else on the maintenance plan NIST describes. If you would rather hand that calendar to someone, that is what our managed IT services exist for. Exit rehearsal: twice a year, restore the owned layer and its data from exports into a clean environment, and time it. If the restore takes longer than the Data Act's 30-day switching window, you have found the next project.

A 20-minute check you can run on Monday

Open a blank page and answer these ten questions for your own site. One point per honest yes.

1. Can you list every system that stores customer, employee or regulated data?
2. For each one, do you know the date of its last security patch?
3. Is anything on that list past its vendor's end of support, or inside 90 days of it?
4. Do you know whether any component has an open entry on CISA's KEV list older than 14 days?
5. If something happened at 2 a.m. today, could you produce a timeline by 6 a.m.?
6. Are the logs that would prove that timeline stored anywhere other than the affected machine?
7. For every SaaS platform you rely on, can you export all of your data in a documented format another system could load?
8. Have you ever tested that export by restoring it somewhere else?
9. For every custom system, is there a signed document that says your company owns the code?
10. Are the source repositories, hosting accounts and domain registrations in your company's name, not a vendor's?

Eight or more means you are in good shape and the rules are a formality. Five to seven means the trap is open but you can still choose the door. Four or fewer means the next incident, or the next renewal, chooses it for you.

Every question maps to a fix that does not require ripping out the platform you already run. If your score says it is time, our legacy modernization and migrations practice starts with the inventory and the instrumentation. We build the owned layer beside the systems you already run. Then we hand over the whole package, with the code 100% yours, at a fixed price, quoted up front.