Board Technology Oversight

Closing the Year Well: The Cyber Items to Carry Into January

The last working days of the year decide how January starts. A short carry-over list, written now, keeps the open items from becoming February's surprises.

A laptop and a closed notebook on a desk at the end of a working day.

The year's last working days have a particular failure mode: everyone half-present, the open items mentally filed under "next year," and January arriving to find that nothing was actually handed over, just dropped.

Closing the year well takes one page. The cyber items being carried into January, each with an owner and a next step, written while the people who know the context are still around to write it.

Key takeaways

  • Items carried into January need an owner and a next step, not a hopeful note.

  • The carry-over list is short by design: the ten things that genuinely matter.

  • Writing it now captures the context that January will have forgotten.

  • The list is the bridge between the year-end review and the new year's expectations.

  • Read it aloud in the first week back; that is the whole control.

Step 1: Gather the open threads

The sources are the year's own records: the risk register's open items, the project list's unfinished lines, the incident reviews whose fixes are mid-flight, the vendor conversations parked in December, the exceptions expiring early next year.

An hour with those five piles produces the list. The discipline is keeping it to the items that genuinely matter, because a thirty-line carry-over list is a junk drawer.

Step 2: Give every item an owner and a next step

"Vendor review" carried into January is a wish. "Vendor review: Sam to book the MSP session by January 15" is a plan. The difference is a name and a dated verb, and it is the entire point of the exercise.

This fictional example shows the page. It is an illustration, not a prescription.

Open item Owner Next step By when
Backup restore drill findings IT provider Exclusion fix verified Jan 10
Expiring risk exceptions Operations lead Renewal review with evidence Jan 20
Fractional CISO checkup CEO Scorecard meeting booked Jan 15
Vendor exit decision COO Recommendation to the board Jan 31

January's first week then has a working agenda instead of a cold start.

Step 3: Write the context January will need

For the few items that matter most, add the two sentences of context that will not survive the holidays: why this is open, what was already tried, what a good answer looks like. The item's owner in January is often a rested stranger to the decision. The note is for them.

The year-end letter to the board is the narrative companion to this working list, and turning findings into a funded plan is where the carry-over items go to get resourced.

Step 4: Read the page in the first week back

The list closes the year only if it opens the next one. Fifteen minutes in the first January week: each owner confirms their items or renegotiates them in the room. After that, the page is just the program's ordinary tracking, which is exactly where these items belong.

Frequently asked questions

How is this different from the year-end review?

The review looks back at what happened and what it taught. The carry-over list looks forward at what is still open. They reference each other, and together they are the year's close.

How long should the list be?

Short enough to read aloud in fifteen minutes. If everything matters, nothing carries. Ten items with owners beat thirty without.

Who compiles it?

Whoever runs the program day to day, reviewed with the executive sponsor before the holidays. It is one of the highest-leverage hours of the year.

What happens to items that do not make the list?

They are consciously deferred, which is a decision, or consciously dropped, which is also a decision. The carry-over exercise forces both into the open, which is half its value.

A Defensible Next Step

Before the last week thins out, write the page: the open items, the owners, the dated next steps, the context notes. January will start working on day one. Book a Decision-Clarity Call if you want a working session to draft it.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Board Technology Oversight

All CISO Insights
Board Technology Oversight

What Changed Since the Last Technology Update?

A useful technology update helps readers see what changed, what stayed the same and what remains an open question without rereading the whole history.