Technology Strategy & Roadmaps

The December Change Freeze: Deciding What Still Ships

A change freeze keeps December stable, but only if someone decides what qualifies for an exception. Set the rule and the exception bar before the month starts.

A laptop with stationery and a phone on a dark desk.

Somewhere in the next few days, most technology shops enter their version of the December change freeze: no releases, no migrations, no configuration experiments until January. The instinct is sound. The month is short-staffed, high-stakes and unforgiving of surprises.

A freeze works only as well as its exception rule. Without one, everything becomes an exception argued by whoever pushes hardest, and the freeze exists on paper while the systems churn underneath it.

Key takeaways

  • A change freeze protects December's stability only if the exception bar is set in advance.

  • The freeze covers change, not response: fixes for active problems still ship.

  • Every exception needs a named approver, a reason and a rollback plan.

  • The freeze is also a gift: a quiet month to plan, document and test.

  • Announce the freeze with dates and the exception path, or it is a rumor.

Step 1: Write the freeze as a rule with dates

A useful freeze says what stops and when: no new features, platform changes or vendor cutovers from the second week of December through the first week of January, for example. Emergency fixes and security response continue, because a freeze that blocks a working fix is not stability, it is delay.

The dates matter as much as the scope. A freeze that fades out informally ends with someone shipping on December 23rd because nobody said not to.

Step 2: Set the exception bar before the pressure arrives

The exception rule answers one question: what is allowed to ship during the freeze? A workable bar is that exceptions fix something actively broken or prevent a dated, external deadline from being missed, and everything else waits.

Each exception gets a named approver, a written reason and a rollback plan. This fictional example shows the record. It is an illustration, not a prescription.

Proposed change Exception case Approver Rollback Verdict
Checkout payment fix Actively losing orders CTO Revert in 10 minutes Approved
New reporting module Team finished early CTO n/a Wait for January
Vendor security patch Closes an exploited weakness CTO + security lead Vendor documented Approved

"We finished early" is the classic non-exception. Idle capacity in December is for planning and cleanup, not for shipping.

Step 3: Use the quiet month on purpose

The freeze's hidden value is the calm it creates. December is when the documentation gets written, the access reviews get done, next year's plan gets its second draft and the response plan gets a walkthrough.

Teams that treat the freeze as dead time start January behind. Teams that treat it as protected time start January ready.

Step 4: Tell the business what the freeze means for them

The business hears "freeze" as "IT is closed." The better message names what continues: support, fixes, security work, and January's pipeline. Requests made now get honest January dates instead of vague December promises.

Getting security into the product plan is the January conversation the freeze should be preparing.

Frequently asked questions

Does a small company need a formal freeze?

A one-paragraph version, yes: dates, what pauses, what continues, who approves exceptions. The formality scales, but the exception rule matters at any size, because December pressure exists at any size.

What about security patches during a freeze?

Security response is exactly what the freeze must not block. The usual pattern is a fast lane: security fixes ship with a named approver and a rollback plan, without the full exception debate.

What if a customer deadline falls inside the freeze?

A dated external commitment is the legitimate exception case, approved by name with rollback ready. The discipline is refusing to let internal enthusiasm impersonate an external deadline.

When should the freeze start and end?

Match your risk season: commonly from about the second week of December to the first full week of January, with retail and logistics starting earlier. The dates should be decided and announced before December begins.

A Defensible Next Step

This week, publish the freeze: the dates, what pauses, what continues, and who approves exceptions. Then give the quiet month a job. Book a Decision-Clarity Call if you want help setting the exception bar for your environment.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Technology Strategy & Roadmaps

All CISO Insights
Technology Strategy & Roadmaps

When the CTO Says We Need to Rebuild

A rebuild proposal is a large bet. Test it against repair, phased replacement and doing nothing, and ask for evidence that the current system cannot scale.

Technology Strategy & Roadmaps

Shadow IT: Finding What Procurement Never Approved

Teams adopt tools without asking. Discover them, classify the risk, then decide to legitimize, replace or block. A five-step workflow for executives.

Technology Strategy & Roadmaps

Legacy System Replacement: The Go/No-Go Questions

Replace, wrap or tolerate an aging system? A go/no-go scorecard weighs business criticality, failure risk, replacement cost and migration risk.