Move legacy .NET off the basement server without breaking what works

For a mid-size line-of-business app — say 200k to 500k lines, a few dozen integrations, one or two SQL Server databases — plan on 6 to 12 months end to end. The first production traffic on the new stack usually happens inside 90 days behind a strangler facade. Full decommission of the legacy footprint is the long tail and depends mostly on how many internal teams consume the old endpoints.

If you handle CUI, ITAR-controlled data, CJIS-scoped records, or you're a contractor inside the JBSA orbit working toward CMMC Level 2, the regulated regions are usually the path of least resistance. They give you FedRAMP High inheritance, US-person operator controls, and audit trails the assessors already understand. For purely commercial healthcare or financial workloads, standard regions with proper controls are often fine.

Strangler-fig pattern, dual-write data migration, and feature flags. We never do big-bang cutovers on production systems that page somebody at 3 a.m. We put a routing layer in front of the legacy app, move one bounded context at a time, run the old and new paths in parallel until reconciliation reports clean for at least two weeks, then retire the old path. Rollback is always a config change.

Yes. As an SDVOSB, we're eligible for set-aside and sole-source vehicles at the federal level, and we work as a sub or prime on state and local contracts. We've handled DIR-adjacent procurement scenarios and understand HUB subcontracting plans. If you're a Texas agency or a prime looking for a qualified veteran-owned subcontractor on a modernization scope, that's a natural fit.

Not everything ports. Web Forms in particular has no clean .NET 8 path. Our usual approach is to isolate the Web Forms surface behind a reverse proxy on Windows, freeze it, and rebuild new functionality as Razor Pages or a SPA against modern APIs. The old UI keeps serving until usage drops below a threshold worth rewriting. Sometimes that takes two years. That's fine.

We don't pretend they don't exist. Stored procs often encode a decade of business logic that lives nowhere else. The realistic path is to keep SQL Server (lifted to RDS or Azure SQL Managed Instance), refactor procs incrementally as the calling code moves to .NET 8, and only consider a different data store for new bounded contexts where the access patterns clearly justify it. Postgres-everywhere is a religious position, not an engineering one.

Yes — staff augmentation is a real offering, not a fallback. We embed senior .NET, cloud, and DevOps engineers into your team under your tech lead, your standups, your repos. Typical engagement is 2 to 5 engineers for 6 to 18 months. All US-based, all background-check eligible, and we can scope to US-person-only or cleared personnel when the contract requires it.

Discovery and architecture assessment is typically a fixed-fee 4 to 6 week engagement in the $40k–$90k range depending on scope. Implementation is usually time-and-materials or milestone-based against a written SOW, with monthly burn ranging from roughly $60k to $250k depending on team size. We'll give you a written estimate with assumptions and risks before you sign anything. No surprise change orders.

Both, but honestly. We build to FedRAMP Moderate or High control baselines and produce the technical artifacts — SSP technical sections, architecture diagrams, control implementation summaries, POA&M inputs. We partner with 3PAOs and compliance specialists for the assessment itself rather than pretending to be auditors. If you need full ATO sherpa services, we'll tell you who to call and integrate with them.