Handle change, incident and recovery

In both cases, the organisation must establish which version was active, what varied, who was exposed, which action was taken and on which test the next step was authorised. Change anticipates this evidence; an incident reconstructs it under time pressure.

The change record describes its object, rationale, affected components, population, risks, tests and rollback. A seemingly minor modification can alter intended purpose, human interaction, logs or dependence on a third party.

• Request — object, rationale, owner and release window
• Impact — functions, data, populations, controls and duties affected
• Exercise — nominal cases, limits, regression and degraded mode
• Decision — approver, reservations, thresholds and rollback criterion
• Record — manifest, versions, result and baseline update

The chronology retains the time, source, version, people informed, decisions and actions. It separates observed facts, hypotheses and information still missing. Clocks and identifiers must support reconciliation across distributed components.

Containment may require immediate suspension, but useful logs, configurations, inputs and outputs are preserved in accordance with applicable rights and retention periods. A correction that modifies the system before facts are retained can make the cause impossible to establish.

The team addresses harm and continuity immediately. In parallel, competent functions assess whether the criteria of a serious incident or another notification regime are met, by which actor and within what time. An internal label does not replace that qualification.

The correction addresses the established cause or explicitly contains uncertainty. The plan identifies affected versions, immediate measures, durable correction, tests, compensating controls and residual risk. A closed ticket without a test result is not evidence of closure.

Recovery requires a known state, a protocol fixed before testing, a representative population, success criteria and an empowered decision-maker. It may be progressive, segmented or subject to enhanced monitoring. The authority separately accepts any remaining reservations.

The final record contains the chronology, preserved evidence, qualification, notifications, causal analysis, corrections, test results and recovery authorisation. Lessons then amend the baseline, thresholds, procedures or architecture.