Protect the public service during migration
A public-sector migration needs a clear account of the service people rely on, including the exceptions and assisted routes that may be easy to miss in a technical design. That service should shape the delivery plan.
Identify dependencies, records, accessibility needs, accountable owners, and any applicable procurement requirements. Move through a limited pilot with explicit acceptance criteria. Rehearse rollback and public-service continuity before the team commits to a wider cutover.
Put it into practice
Start with a single public service and a documented user journey. Test accessibility and data exchange before infrastructure replacement. Reconcile migrated records and rehearse rollback while the previous service can still be restored.
Implementation steps
- Define the loss scenarioWrite a specific event, the affected service, the people or revenue it could disrupt, and the dependencies that make the event credible. Separate observed conditions from assumptions.
- Compare real optionsDescribe the smallest useful treatment, a broader alternative, and explicit acceptance. Include implementation effort, operating cost, delivery dependencies, and what exposure remains under each choice.
- Give the decision an ownerName the person who can authorize the business trade-off and the person who will deliver it. Record the due date, exception expiry, and escalation route if a dependency blocks progress.
- Close with evidenceDecide in advance what test or observation would demonstrate improvement. At the next review, show that evidence and any remaining uncertainty instead of substituting activity counts for outcomes.
Track decision coverage and treatment timeliness
| Measure | Calculation or definition | How to use it |
|---|---|---|
| Decision coverage | Decisions with an accountable approver / material decisions in scope | Investigate unowned decisions before adding more reporting. |
| Treatment timeliness | Actions completed by agreed date / actions due in the period | Show overdue dependencies and accepted exceptions separately. |
| Evidence coverage | Treatments independently verified / treatments reported complete | Keep unverified completion visible until a reviewer can reproduce it. |
Evidence-backed decisions
Worked example. Figures are illustrative.
| Observation | Decisions |
|---|---|
| In scope | 20 |
| Owner assigned | 15 |
| Evidence verified | 12 |
The denominator is all material decisions in this example, not only the items the team finished.
The record to keep
The deliverable: A public-service pilot decision record with accessibility evidence, reconciliation totals, and rollback criteria.
Ask the service owner to demonstrate a complete user journey after the pilot. Resolve failed or inaccessible steps before authorizing the next migration stage.
References
- NIST Cybersecurity Framework — Use outcomes and organizational context to organize the risk discussion; a framework mapping is not a control test.
- NIST SP 800-61 Rev. 3: Incident Response — Connect preparation, detection, response, and recovery with the wider risk-management program.
Keep reading.
Your Access List Is a Museum. Time to Clean It Out.
An access review needs more than a list of active employees. Supplier accounts, service identities, inherited permissions, and active sessions can preserve access after the original reason has ended.
3 min read →
October 30 market close: Intel plunges, Nasdaq falls 2.86%
Intel falls 28.58% as its outlook weighs on technology. Nasdaq loses 2.86%, energy leads sector gains, and labor-cost data and weekly returns frame the Friday close.
4 min read →
October 29 market close: Alphabet sinks, small caps advance
Alphabet falls 12.64% and the Nasdaq loses 1.38%, while small caps and nine sector ETFs gain. GDP, inflation and Amazon earnings frame a sharply divided session.
4 min read →