Business Continuity

Business continuity is the ability of an organization’s essential processes to keep operating during and after a disruption. NIST defines a business continuity plan as documented procedures describing how mission and business processes will be sustained during and after a significant disruption. A planned system change is a disruption the organization chooses, so it needs the same kind of statement.

State what must survive the change

For a fictional invoice-evidence report, the continuity requirements might be: authorized clerks can obtain the records they need each morning, order identifiers keep their meaning, historical evidence stays accessible under its retention rules, and approvals are neither duplicated nor bypassed. These are requirements on the change, written before the design, and they hold whatever technology is chosen.

Continuity is not the same as zero downtime. Some processes need uninterrupted service; others tolerate a planned pause of a few hours or a limited manual fallback. Agree on the actual tolerance for each process, because the tolerance decides whether a phased transition, a short outage window, or a parallel run is acceptable.

Measure continuity, and measure where the work went

A continuity requirement is testable when it has a population, a period, and a rule: the report is available by 08:00 on at least 58 of the first 60 working days after the change, with failures counted and recovery timed. Deployment success is not evidence of continuity; the measurements after the change are.

A process can look continuous because another team absorbed the work, for example a finance clerk correcting an export by hand each morning. Measure minutes moved to other teams on the same days, and treat an increase as a breach of the continuity requirement rather than as an acceptable side effect.

Reference: NIST glossary: business continuity plan. Figures here are illustrative.