Freeze New Vendor Access Until January

Every year, someone signs a vendor in the Q4 rush and wants them "set up before the holidays." The request lands on the desk of whoever manages accounts, half the team is already out, and access gets granted quickly because everyone wants to close the year clean.

This is exactly backwards. The two quietest weeks of the year are the worst time to add new outside access to your systems, because the people who would notice something odd are the people who are away.

TLDR

• The quietest weeks are the worst time to grant new outside access, because nobody is watching.

• A freeze covers new accounts, new integrations and new data sharing; existing access continues.

• Announce it this week, with a named exception path, so nobody is surprised.

• Use the quiet weeks to prepare January onboardings instead of rushing December ones.

Why late December is different

Access risk is not about the vendor being bad. It is about the window between access being granted and anyone actually watching how it is used. In a normal week that window is short: accounts get used, logs get noticed, questions get asked.

In the last two weeks of December the window stretches. The person who granted the access is out. The person who would review it is covering two jobs. A misconfigured permission or a compromised vendor account has days to sit quietly before anyone looks.

Attackers know this calendar better than most businesses do. The holiday period is when odd access is least likely to be questioned.

What a freeze actually means

A freeze is simple: no new vendor accounts, no new integrations, no new data sharing between now and the first full week of January. Existing vendors keep the access they already have. Emergencies get an exception, granted by a named person, in writing, with a review date.

The word that makes it work is "announced." Tell your team and your vendors now, this week, while there is still time to rush something through properly if it genuinely cannot wait. A freeze announced on December 23rd is just a no. A freeze announced on December 16th is planning.

Most vendors will not push back. They have their own quiet weeks, and a January onboarding with full attention serves them better than a rushed December one.

Use the quiet weeks to prepare instead

The freeze does not stop the work; it stops the risk. The last two weeks of December are a good time to do everything except grant access: collect the vendor's security documentation, agree on what access they actually need, decide who approves what.

That is exactly the checklist approach we laid out for onboarding new vendors securely. Do the paperwork in December, flip the switch in January when everyone is back and watching.

The one-paragraph version for your team

If you send nothing else, send this: "No new vendor access or integrations between December 20 and January 5. Existing access stays as it is. Genuine emergencies go through me, in writing. Anything else, we prepare now and switch on in January."

Four sentences. That is the whole control, and it costs nothing but a little advance notice.

Frequently asked questions

What counts as an emergency exception?

Something the business cannot run without: a failed system that needs a vendor's hands to restore. Convenience and year-end enthusiasm are not emergencies.

Does this apply to software purchases too?

Buying is fine. Connecting is what waits. Sign the contract if you must, but the account creation, the integration and the data flow wait for January.

Will vendors be annoyed?

Almost never. A clear date and a prepared onboarding reads as professionalism, and most vendors are running their own skeleton crews.

A practical next step

Send the freeze note to your team and any vendors mid-onboarding this week. If you are not sure which outside parties currently have access to what, that is the real finding, and a Decision-Clarity Call can help you map it before January.