Answers to the questions practitioners most commonly ask about COG.
Is continuity of government the same as disaster recovery or IT backup?
No, though the concepts overlap and are often confused. Continuity of government refers to the arrangements ensuring that essential governmental functions and lawful authority can continue during and after a disruption. Disaster recovery and IT backup are narrower technical activities focused on restoring systems and data. From a recordkeeping perspective, continuity of government depends on more than backups: it requires that authoritative records supporting essential functions remain authentic, reliable, and usable, and that the evidence of decisions and authority survives the disruption. Backing up data does not by itself preserve the record properties that make information trustworthy as evidence, so continuity planning and disaster recovery should be treated as related but distinct.
Does continuity of government simply mean keeping copies of important documents in a safe place?
Not exactly. Storing copies is only one element, and copies are not the same as authoritative records. Continuity of government is concerned with maintaining the records that provide evidence of governmental activity, authority, and obligations, and with preserving their authenticity, integrity, and usability over time. This typically involves identifying which records are essential to essential functions, ensuring appropriate redundancy and protection, and being able to demonstrate that a preserved record has not been altered. Merely holding a duplicate document, without controls over its provenance and integrity, may not satisfy the evidential needs that continuity arrangements are intended to address.
How do we identify which records are essential to continuity of government?
Identification typically begins by mapping the essential functions that must continue during a disruption, then tracing the records that support those functions, such as records establishing legal authority, rights and obligations, and the information needed to resume or sustain operations. Many organizations conduct this analysis alongside business impact assessments and involve records management, legal, risk, and operational stakeholders. The scope and criteria will depend on organizational policy, mandate, and applicable jurisdictional requirements, so essential-records determinations are usually documented and reviewed periodically rather than fixed once.
Where should essential records be stored to support continuity arrangements?
Approaches commonly emphasize redundancy and geographic or environmental separation so that a single incident is unlikely to compromise all copies. Options may include off-site or alternate-site storage, distributed or replicated digital repositories, and arrangements that keep protective copies at a sufficient distance from the primary location. Whatever the arrangement, the emphasis in recordkeeping is on preserving authenticity, integrity, and usability, which means access controls, integrity checks, and documented custody typically matter as much as physical location. Specific requirements often depend on jurisdiction, sector, and organizational risk tolerance.
How does continuity of government relate to normal retention and disposition schedules?
Continuity requirements generally operate alongside, rather than replace, ordinary retention and disposition rules. A record identified as essential for continuity still has its own retention period and eventual disposition, which may involve destruction, transfer, or permanent preservation depending on its classification. Organizations often reconcile the two by ensuring that essential-record protections are applied throughout the period the record is retained, and by avoiding situations where a continuity copy persists uncontrolled after the authoritative record has been lawfully dispositioned. Coordination between continuity planning and the retention schedule helps prevent conflicting instructions.
How can an organization verify that its continuity of government arrangements will actually work?
Verification typically relies on testing, exercising, and review rather than assumption. This can include periodic exercises that simulate loss of the primary environment, checks that protective copies are current and complete, and confirmation that preserved records can be located, accessed, and demonstrated to be authentic and unaltered. Documenting the results and updating essential-records inventories, contact information, and procedures is a common practice. The frequency and rigor of testing usually depend on organizational policy and applicable requirements, and testing is generally treated as an ongoing obligation rather than a one-time event.