Ten years, four Drupal versions, one migration

The challenge

Most organisations treat a major CMS upgrade as a five-year event to be delayed for as long as possible, and ORX’s content couldn’t survive that kind of delay.

Why upgrades usually stall

For most organisations still running an old major version of a CMS, the upgrade has stopped being a project and become a standoff. Every board conversation about it starts the same way: how much will it cost, how long will it take, and what breaks while we’re mid-migration. Because nobody wants to own that answer, the gap between the version in production and the version that’s actually supported keeps growing, along with the security exposure and the eventual size of the bill.

Why ORX couldn’t afford to stall

ORX is the largest operational risk association in financial services. Its news and research platform is where their members and subscribers go to check the latest operational and non-financial risk research, publicly-reported losses analysis, often as part of their own compliance process, so accuracy and uptime aren’t nice-to-haves. When Box UK first built the platform on Drupal, that meant a tailored editorial workflow strict enough to keep sensitive risk content properly validated, but fast enough that ORX’s team could still publish same-day analysis. Every subsequent Drupal upgrade had to protect that workflow rather than force ORX’s editorial team to relearn it.

The solution

Box UK has upgraded ORX’s Drupal platform four times in a decade by treating each release as scheduled maintenance, not a crisis project:

• Drupal 7 to 8: there was no direct upgrade path between these versions, so this was a genuine migration. Box UK exported, reformatted and re-imported over 6,000 sensitive risk documents and configurations into a new Drupal 8 build, rather than leaving ORX to face that jump unsupported.
• Drupal 8.5 to 8.6 (2018): both the News and Members platforms were upgraded together, updating third-party dependencies and stabilising the single sign-on that lets members move between the two sites without re-authenticating.
• Drupal 9.4 (2022): a further planned upgrade across both platforms, timed ahead of the PHP and infrastructure changes that followed.
• Into 2026 and beyond, ORX and Box have continued to work together to ensure the platform is stable, secure and supported through continual planned upgrades..

The outcome

Staying current has kept ORX off the cliff edge that a delayed upgrade eventually creates, without disrupting members or the editorial team:

• No cliff edge. Because no version has been left to go unsupported, there’s never been a moment where security risk forced an emergency rebuild under time pressure.
• Continuity for members. The SSO connecting the News and Members sites has carried through every migration, so member access hasn’t been interrupted by the platform underneath it changing.
• An editorial workflow that’s never been rebuilt from scratch. The validation process ORX’s team relies on to publish daily analysis has been preserved, not reconstructed, at every stage.
• Security and performance improvements land on schedule, not years after the fact.