Nothing to Decide This Week, and That Is Fine
The week between the holidays does not need a cyber agenda. A board that has done its year-end work has earned a quiet week, and should say so.

There is a strange pressure in the week between the holidays to produce something: a summary, a resolution, a plan for January that arrives pre-cooked. Resist it. If the year's oversight work was done, this week has no cyber agenda, and that is not a gap. It is the system working.
A board that cannot let a quiet week be quiet teaches management to manufacture urgency. That is a habit with a long and expensive tail.
TLDR
A quiet week without a cyber agenda is the year's work paying off, not a gap.
Rest is a control: tired people make next year's incidents.
No quiet-week projects. The change freeze covers the holidays for a reason.
If the chair marks the week at all, one grateful sentence is enough.
Quiet is a sign of health, not neglect
A business that can close for a few days without a technology emergency is showing you the result of the year's work: backups that run, access that is in order, an on-call list that exists. The absence of drama is the product.
Boards sometimes struggle to see this because oversight is trained on activity: reports, metrics, decisions. But the point of all that activity is precisely a week like this one, where nothing needs deciding and the business simply runs.
What this week is actually for
For the board, nothing. For management, rest, which is a security control whether or not it appears in any framework. Tired people make the mistakes that fill next year's incident log, and a leadership team that never stops is a risk factor with a corner office.
The one legitimate technology act this week is the one already arranged: the on-call list exists, someone does the daily glance, and everyone else is genuinely off.
The discipline of not manufacturing work
The failure mode to avoid is the "while things are quiet" project: the migration, the upgrade, the mailbox cleanup scheduled for the week nobody is around. Quiet weeks are when change is riskiest, because the people who would catch a mistake are out.
Hold the line. The freeze on changes and new vendor access covers this week exactly. January is days away, and it will bring fresh eyes and full staffing to anything that genuinely needs doing.
One sentence is enough
If the chair wants to mark the week, one sentence to the team does it: thank you, the year is in good shape, see you in January. No attachment, no request, no homework.
It is a small thing, but boards set the emotional weather. A board that can say "we are in good shape" when it is true makes its serious moments land harder when they come.
Frequently asked questions
Should the board meet between the holidays?
Only for a genuine emergency. A routine meeting in the quiet week signals that rest is not actually sanctioned, whatever the calendar says.
What if something does come up?
That is what the on-call list and the escalation path are for. One named person decides whether it can wait, and almost everything can.
Is a year-end thank-you message appropriate?
Yes, and keep it short. Gratitude without a request attached is rare enough that people notice it.
A practical next step
Let the week be quiet, and check that the on-call list and daily glance are the only technology obligations anyone carries into it. If the quiet feels uneasy because you are not sure those exist, book a Decision-Clarity Call for early January.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


