Business Continuity

Business continuity is the ability of an organization’s essential processes to keep operating during and after a disruption. NIST defines a business continuity plan as documented procedures describing how mission and business processes will be sustained during and after a significant disruption. A planned system change is a disruption the organization chooses, so it needs the same kind of statement.

State what must survive the change

For a fictional invoice-evidence report, the continuity requirements might be: authorized clerks can obtain the records they need each morning, order identifiers keep their meaning, historical evidence stays accessible under its retention rules, and approvals are neither duplicated nor bypassed. These are requirements on the change, written before the design, and they hold whatever technology is chosen.

Continuity is not the same as zero downtime. Some processes need uninterrupted service; others tolerate a planned pause of a few hours or a limited manual fallback. Agree on the actual tolerance for each process, because the tolerance decides whether a phased transition, a short outage window, or a parallel run is acceptable.

Measure continuity, and measure where the work went

A continuity requirement is testable when it has a population, a period, and a rule: the report is available by 08:00 on at least 58 of the first 60 working days after the change, with failures counted and recovery timed. Deployment success is not evidence of continuity; the measurements after the change are.

A process can appear continuous because another team absorbs extra work, such as a finance clerk correcting an export each morning. Measure that effort rather than hiding it in the deployment result. An approved manual fallback may legitimately add work for a bounded period. Agree its staffing, time, error-rate, and duration limits in advance, and record a breach when those limits or other continuity requirements are missed. Unplanned permanent work transfer is different from an accepted temporary contingency.

Figures here are illustrative.

References

• NIST glossary: business continuity plan