Architectural Refactoring Strategies for Legacy Critical Digital Infrastructure (ARF-CDI): A Roadmap for Secure Modernization

Abstract

Critical digital infrastructure (CDI) in energy, water, healthcare, and telecommunications still runs on architectures designed decades ago, when networks were isolated and adversaries were not part of the design brief. Operators have responded to rising attack activity by layering controls onto these architectures. The controls treat symptoms; the flat topology and implicit trust that let attacks propagate stay in place. Standards such as NIST SP 800-82, IEC 62443, and zero trust guidance describe the target state but not the transformation path from a legacy architecture to it. This study applies Design Science Research to develop the Architectural Refactoring Framework for CDI (ARF-CDI): a seven-dimension architecture assessment, eight refactoring principles with explicit satisfaction tests, a catalogue of 12 architecture-level refactoring strategies with a dependency layer, a weighted prioritization model, and a seven-phase modernization roadmap. Each framework element is traced to its evidence base, and the prioritization model is tested for rank stability across nine structured weighting scenarios and a Monte Carlo exploration of weight and score uncertainty. The framework is demonstrated on an illustrative composite case of a legacy power utility; the case inputs, weakness register, and scoring rationale are supplied in full so the demonstration can be reproduced and challenged. Evaluation at this stage is descriptive, against nine independent criteria, and the case reports prioritization and architectural-structure results, not measured risk reduction. The framework offers operators a candidate method for turning an open-ended modernization problem into a ranked, sequenced, and verifiable programme of architectural change.