Trust & Resilience

The Holiday On-Call List: Names, Not Roles

A holiday on-call list that says "IT" or "the office" reaches nobody at 9pm on Christmas Eve. Real names, real numbers, tested before everyone leaves.

A flat lay of a keyboard, spiral notebook, earphones and a succulent on a yellow surface.

Every business has a holiday contact plan, and most of them say something like "for IT issues, contact IT." At nine in the evening on Christmas Eve, with the alarm company on the phone and the building heat cycling strangely, "contact IT" reaches exactly nobody.

A working on-call list is shorter and more specific than that. It names people, with their actual phone numbers, in an order, with a clear rule for what counts as worth calling about. It takes an hour to build and one test call to trust.

Key takeaways

  • Roles do not answer phones. The list needs names and personal numbers, in order.

  • Define what is worth a holiday call before the call has to be made.

  • Include the outsiders: alarm company, IT provider, plumber, power utility.

  • One test call per name, before everyone leaves, proves the list works.

  • Post it where the closing person can see it, not in a folder nobody opens.

Step 1: Decide what earns a call

Start with the trigger list, not the names. What is bad enough to interrupt someone's holiday? Water where it should not be, heat loss in January-cold weather, a security alarm, systems down for customers, a payroll failure. Write the list before negotiating who answers it.

The trigger list does two jobs: it tells the person on site when to call, and it tells the person on call that being called is not an overreaction.

Step 2: Assign names in an order

Each trigger gets a first name and a second name, with personal mobile numbers. Not "the manager"; a person. If the first name does not answer in fifteen minutes, the second name gets called. Nobody is third.

Check willingness out loud. A name on a list who does not know they are on the list is a role, not a name.

Step 3: Include the outsiders on the same page

Half the holiday problems get solved by someone outside the business: the alarm company, the IT provider's emergency line, the plumber, the power utility, the landlord. Their numbers belong on the same page, current, with account numbers where the phone tree will ask for one.

This is the companion to the skeleton-crew runbook for the working days between the holidays: the runbook covers the daytime, the on-call list covers everything else.

Step 4: Test it before everyone leaves

One call or one text per name, this week, while everyone is still working: "This is the holiday on-call test, no action needed." It proves the numbers are right, it tells people they are on the list, and it surfaces the phone that goes to voicemail.

Then print it. The list lives where the last person out can see it: taped inside the door, in the alarm panel cabinet, in the shared drive everyone can actually reach from a phone.

Frequently asked questions

Should on-call people be paid?

That is a policy question for your business, but decide it before the list goes out. People answer phones more reliably when the arrangement is explicit.

How many names is enough?

Two per trigger. One is a single point of failure; three means everyone assumes someone else will answer.

What about the owner being the answer to everything?

Common and fragile. If every trigger routes to you, the list exists to protect your holiday, not the business. Assign what others can genuinely handle.

A practical next step

Build the one-page list this week and run the test calls before people scatter. If your honest answer is that nobody could handle a systems problem over the break, that is worth a Decision-Clarity Call before the holidays, not after.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Trust & Resilience

All CISO Insights
Trust & Resilience

What to Do the Monday After a Competitor's Breach

A competitor's public breach is a free lesson. A five-day learning review converts it into an exposure check, a control gap check and a board note.

Trust & Resilience

Who Can See Your Most Sensitive Data Right Now?

Who holds access to your most sensitive data right now - people, service accounts and vendors? If nobody can answer with evidence, that is the finding.