Cutover is a sequence of decisions against a clock
A cutover turns a system in use into another system that the business can use. It must preserve data coherence, stop writes at the right moment, activate access and enable business journeys. A technical task list is insufficient. Between tasks, someone must recognise that the result is correct and authorise the next step. Without that authority, the window becomes a series of implicit bets on data, interfaces and available operators.
This guide distinguishes prepared, frozen, technically transferred and open for business states. Each has evidence and an owner. Finishing a load does not mean opening. Recovery is not simply restoring a backup: it must explain what happens to transactions created since the freeze. The rehearsal should support a decision before the clock removes the available options.
Fictional Friday-to-Saturday cutover
A fictional company replaces its order management tool. All timings, volumes and thresholds are teaching examples and describe no CYTIZEN engagement. Writes stop on Friday at 20:00 and operators resume on Saturday at 06:00, giving a ten-hour window. The latest rehearsal measures fallback at 95 minutes, final source checks at 35 minutes and communication at ten minutes. Add a 20-minute contingency allowance.
The latest decision point is therefore 06:00 minus 160 minutes, or 03:20. Continuing beyond it requires a different solution from the planned fallback. The cutover director cannot recover time by trimming finance checks or user communication. Recalculate after each rehearsal and record measured durations, variability and tasks that genuinely can run in parallel. The limit is an operational calculation rather than a convenient meeting time.
Worked hourly runbook
| Fictional time | Action and evidence | Owner | Decision |
|---|---|---|---|
| 19:30 | Confirm staff, backup and independent communication | Cutover director | Postpone if an essential operator is absent |
| 20:00 | Freeze writes and record last message identifier | Operations lead | Release extraction only after freeze evidence |
| 20:20–22:10 | Extract, transform and load; retain logs and fingerprints | Migration lead | Stop on missing batch or failed control |
| 22:10–23:20 | Reconcile orders, quantities and balances | Finance and data | Proceed only if invariants hold |
| 23:20–00:40 | Test access, order, shipment, invoice and return | Business owners | Classify defects and test workarounds |
| 00:40–02:30 | Activate interfaces and observe unique messages | Integration lead | Fall back if duplicates cannot be controlled |
| By 03:20 | Choose opening or fallback with consolidated evidence | Business sponsor | Fall back if a blocking criterion remains |
| 06:00 | Controlled restart and transaction monitoring | Operations manager | Release volume through approved stages |
Freeze every write path and preserve in-flight work
The freeze covers users, robots, imports, interfaces and scheduled jobs. Blocking a screen does not necessarily block an API. Integration staff identify the last received message, the last processed message and remaining queues. Drain in-flight operations before extraction or preserve them in a queue with a documented restart method. Do not leave operators to reconstruct these operations later from scattered logs.
Operations stops scheduled tasks in a verified order and records actual times. Align clocks and specify the time zone. The data team captures frozen reference counts, totals and boundary identifiers. Keep an emergency communication route independent of the system being switched. Orders arriving during the outage need an explicit destination and owner, or they may disappear between sales, support and logistics.
Reconciliation must establish meaning
Equal row counts do not establish correct migration. Records can be swapped, currencies dropped or cancelled orders reactivated. This exercise checks orders by status, amounts by currency, open quantities by item and links between orders, shipments and invoices. Finance accepts financial totals, logistics accepts quantities and statuses, and data specialists supply technical evidence. The acceptance record distinguishes the person producing the comparison from the person judging its business meaning.
Coverage equals objects reconciled with conforming controls divided by expected objects in scope. The fictional scenario requires 100% for balances and open orders. A EUR 0.01 rounding difference can be accepted only when its cause and cumulative limit were defined before cutover. An unexplained difference of the same value remains a defect. Materiality does not eliminate the need to understand the cause.
Retain readable journey samples alongside aggregates. An invoice should contain coherent customer, tax, due date and document reference. Essential attachments and histories need separate checks. Correct financial totals do not help answer a customer if shipment evidence is missing. Label expected exclusions, such as deliberately archived history, so that they are distinguishable from accidental loss.
Make fallback executable and time-bounded
The fallback plan specifies commands, permissions, restoration environment and tests needed to reopen the source. It also closes writes on the target, preserves diagnostics and accounts for any new transactions. In this example no live business writes are allowed before the opening decision, simplifying recovery. An earlier partial opening requires an additional mechanism for returning new transactions to the source.
A rehearsal must demonstrate fallback rather than merely call it possible. Measure from the decision until restored business capability, including interfaces, reconciliation and user communication. Technical restoration taking 40 minutes may need another hour of checks. The cutover director rejects artificial reductions in the time reserve. After the deadline, leadership no longer has the same choice: continued migration requires a separate continuity procedure approved beforehand.
Keep stop criteria usable at three in the morning
Four conditions block opening in this exercise: an unexplained financial balance, a lost open order, unauthorised customer-data access or an interface generating uncontrolled duplicates. A nonessential document-format defect may be accepted if a tested alternative handles the expected volume. Record consequences, owner, solution and required time for every anomaly. Voting a defect down without new evidence does not resolve it.
The business sponsor authorises opening and the cutover director coordinates. Control owners flag blockers within their domains. Assign one person to the log and another to the clock so coordination is not consumed by data entry. Name substitutes, verify contact details and organise handovers. Fatigue weakens decisions; shifts and breaks therefore belong in the operating plan.
Monitor business activity after opening
This scenario opens in volume stages with identified operators. Track orders created, messages rejected, invoices issued, shipments completed and support delays. Perfect technical availability can coexist with a blocked business queue. Compare activity against a reference matching the day and transaction type. Keep known defects under ownership even after formal handover from the project to operations.
The first complete cycle may include closing, periodic invoicing or payment. Retain the people capable of diagnosing these delayed operations. End enhanced support when evidence is sufficient rather than on a date alone. The review records actual durations, differences from rehearsal, decisions and workarounds. That record becomes a practical reference for later cutovers; a success presentation without underlying logs does not provide the same evidence.
Sector implications
A continuously operating factory may have a short window and need to preserve production data while the ERP is unavailable. Distinguish local equipment from central applications. Retailers must retain overnight web orders, prioritising queuing, acknowledgement and duplicate prevention. Financial operations need specific balance, value-date and reconciliation controls before transactions resume.
Professional services may prioritise time entry, document access and contract invoicing. Across sectors, calculate the fallback limit from actual operations and let business owners choose invariants. Copying another programme’s timetable creates no assurance. Preparation makes the exceptional window a set of reproducible decisions supported by evidence the organisation can inspect and challenge before opening.
Sources and method
This guide is a 2022 retrospective. The 2010 NIST SP 800-34 Rev. 1 provides a reference for planning, exercises and reconstitution. GDPR articles 28 and 32 inform personal-data protection, availability and controls. Neither source prescribes this fictional schedule, financial threshold or latest decision time. Verification in 2026 does not establish later practices as part of the 2022 baseline.
Primary sources checked in October 2026. NIST SP 800-34 Rev. 1, 2010. CNIL, RGPD, articles 28 et 32.
All situations, amounts, durations and thresholds are fictional teaching examples. They illustrate a decision method and do not describe any CYTIZEN engagement or market benchmark. The operational recommendations are the author’s proposals, separate from the cited documents.