DATA MIGRATION CUTOVER AND ROLLBACK WORKSHEET
Reviewed: October 1, 2026
Article: https://softwaremodernizationservices.com/insights/data-migration-rollback-planning/

Planning template. Attach a versioned runbook rehearsed on your platform; the
worksheet itself is not an executable recovery procedure. Replace role labels
with names and reachable alternates. Link evidence; omit credentials and customer data.

1. SCOPE AND DECISION AUTHORITY

Change identity: Change ID, runbook version, rehearsal date, source/target engines
and versions, datasets, applications, and exclusions:
____________________________________________________________________________
Decision authority: Named cutover/rollback decision maker and alternate; how to
reach them; escalation deadline if neither responds:
____________________________________________________________________________
Execution owners: Named database/replay operator, application/write-fence operator,
data acceptance owner, service acceptance owner, and communications owner:
____________________________________________________________________________
Recovery contract: Approved RPO and RTO, transaction coverage, clock start/end,
availability assumptions, and who may accept an exception:
____________________________________________________________________________
Point of no return: Observable event/deadline, monitor, owner, and approved action
after crossing it:
____________________________________________________________________________

2. WRITE BOUNDARIES AND RECOVERY DATA

All writers: Applications, connection pools, workers, queues, ETL jobs, schedulers,
integrations, and administrative sessions:
____________________________________________________________________________
Source fence: Platform-specific procedure, treatment of in-flight transactions
and queued work, evidence that every source writer is stopped or rejected, and
final source commit position:
____________________________________________________________________________
Final synchronization: Applied target position, lag/backlog evidence, rejected
changes, snapshot boundaries, and reconciliation report:
____________________________________________________________________________
Target write opening: Named approval, opening timestamp, first target commit/capture
position, and source-fence confirmation:
____________________________________________________________________________
Post-cutover capture: Inserts, updates, deletes, key changes, ordering, transaction
boundaries, checkpoint/retry rules, retention deadline, monitoring, and owner:
____________________________________________________________________________
Reverse compatibility: Versioned inverse mappings, non-reversible fields, conflict
policy, sequence/identity handling, and old application compatibility:
____________________________________________________________________________
External effects: Payments, messages, files, downstream changes, and retry/
deduplication or compensation procedures with owners:
____________________________________________________________________________
Recovery fence: Target-fence procedure, drained/aborted transactions, final target
commit/capture position, and evidence the recovered source stays fenced during replay:
____________________________________________________________________________

3. TRIGGERS, ACCEPTANCE, AND RELEASE

Triggers and stop conditions: Signal, threshold, observation window, evidence
location, observer, and escalation; include missing capture, incompatible replay,
and unexplained discrepancies:
____________________________________________________________________________
Recovery sequence: For each step: prerequisite, tested command/script version,
expected result, evidence, operator, stop condition, and next escalation:
____________________________________________________________________________
Replay evidence: Captured boundary, applied boundary, backlog/gaps, rejected events,
duplicate/conflict handling, and insert/update/delete reconciliation:
____________________________________________________________________________
Acceptance checks: Key-set and mapped-value equality, critical totals/relationships,
approved exceptions, old application workflows, access controls, and dependent
systems; name each approver:
____________________________________________________________________________
Reopen service: Decision record, data/service owner approvals, single active writer
confirmation, endpoint/pool checks, monitoring, and communications:
____________________________________________________________________________
Rehearsal and retention: Actual recovery time/data loss, environment differences,
unresolved gaps, rerun evidence, rollback-path expiry, and separate source-decommission
approval:
____________________________________________________________________________

HOLD AND ESCALATE if the changed-data boundary is unknown, capture has gaps,
reverse mappings cannot represent accepted data, or reconciliation fails. Keep
application writers fenced until data and service owners approve recovery.