Closing the Year Well: The Cyber Items to Carry Into January
The last working days of the year decide how January starts. A short carry-over list, written now, keeps the open items from becoming February's surprises.

The year's last working days have a particular failure mode: everyone half-present, the open items mentally filed under "next year," and January arriving to find that nothing was actually handed over, just dropped.
Closing the year well takes one page. The cyber items being carried into January, each with an owner and a next step, written while the people who know the context are still around to write it.
Key takeaways
Items carried into January need an owner and a next step, not a hopeful note.
The carry-over list is short by design: the ten things that genuinely matter.
Writing it now captures the context that January will have forgotten.
The list is the bridge between the year-end review and the new year's expectations.
Read it aloud in the first week back; that is the whole control.
Step 1: Gather the open threads
The sources are the year's own records: the risk register's open items, the project list's unfinished lines, the incident reviews whose fixes are mid-flight, the vendor conversations parked in December, the exceptions expiring early next year.
An hour with those five piles produces the list. The discipline is keeping it to the items that genuinely matter, because a thirty-line carry-over list is a junk drawer.
Step 2: Give every item an owner and a next step
"Vendor review" carried into January is a wish. "Vendor review: Sam to book the MSP session by January 15" is a plan. The difference is a name and a dated verb, and it is the entire point of the exercise.
This fictional example shows the page. It is an illustration, not a prescription.
| Open item | Owner | Next step | By when |
|---|---|---|---|
| Backup restore drill findings | IT provider | Exclusion fix verified | Jan 10 |
| Expiring risk exceptions | Operations lead | Renewal review with evidence | Jan 20 |
| Fractional CISO checkup | CEO | Scorecard meeting booked | Jan 15 |
| Vendor exit decision | COO | Recommendation to the board | Jan 31 |
January's first week then has a working agenda instead of a cold start.
Step 3: Write the context January will need
For the few items that matter most, add the two sentences of context that will not survive the holidays: why this is open, what was already tried, what a good answer looks like. The item's owner in January is often a rested stranger to the decision. The note is for them.
The year-end letter to the board is the narrative companion to this working list, and turning findings into a funded plan is where the carry-over items go to get resourced.
Step 4: Read the page in the first week back
The list closes the year only if it opens the next one. Fifteen minutes in the first January week: each owner confirms their items or renegotiates them in the room. After that, the page is just the program's ordinary tracking, which is exactly where these items belong.
Frequently asked questions
How is this different from the year-end review?
The review looks back at what happened and what it taught. The carry-over list looks forward at what is still open. They reference each other, and together they are the year's close.
How long should the list be?
Short enough to read aloud in fifteen minutes. If everything matters, nothing carries. Ten items with owners beat thirty without.
Who compiles it?
Whoever runs the program day to day, reviewed with the executive sponsor before the holidays. It is one of the highest-leverage hours of the year.
What happens to items that do not make the list?
They are consciously deferred, which is a decision, or consciously dropped, which is also a decision. The carry-over exercise forces both into the open, which is half its value.
A Defensible Next Step
Before the last week thins out, write the page: the open items, the owners, the dated next steps, the context notes. January will start working on day one. Book a Decision-Clarity Call if you want a working session to draft it.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


