Board Cyber Oversight

Nothing to Decide This Week, and That Is Fine

The week between the holidays does not need a cyber agenda. A board that has done its year-end work has earned a quiet week, and should say so.

A notebook, keyboard, mouse, clips and green leaves on a white surface.

There is a strange pressure in the week between the holidays to produce something: a summary, a resolution, a plan for January that arrives pre-cooked. Resist it. If the year's oversight work was done, this week has no cyber agenda, and that is not a gap. It is the system working.

A board that cannot let a quiet week be quiet teaches management to manufacture urgency. That is a habit with a long and expensive tail.

TLDR

  • A quiet week without a cyber agenda is the year's work paying off, not a gap.

  • Rest is a control: tired people make next year's incidents.

  • No quiet-week projects. The change freeze covers the holidays for a reason.

  • If the chair marks the week at all, one grateful sentence is enough.

Quiet is a sign of health, not neglect

A business that can close for a few days without a technology emergency is showing you the result of the year's work: backups that run, access that is in order, an on-call list that exists. The absence of drama is the product.

Boards sometimes struggle to see this because oversight is trained on activity: reports, metrics, decisions. But the point of all that activity is precisely a week like this one, where nothing needs deciding and the business simply runs.

What this week is actually for

For the board, nothing. For management, rest, which is a security control whether or not it appears in any framework. Tired people make the mistakes that fill next year's incident log, and a leadership team that never stops is a risk factor with a corner office.

The one legitimate technology act this week is the one already arranged: the on-call list exists, someone does the daily glance, and everyone else is genuinely off.

The discipline of not manufacturing work

The failure mode to avoid is the "while things are quiet" project: the migration, the upgrade, the mailbox cleanup scheduled for the week nobody is around. Quiet weeks are when change is riskiest, because the people who would catch a mistake are out.

Hold the line. The freeze on changes and new vendor access covers this week exactly. January is days away, and it will bring fresh eyes and full staffing to anything that genuinely needs doing.

One sentence is enough

If the chair wants to mark the week, one sentence to the team does it: thank you, the year is in good shape, see you in January. No attachment, no request, no homework.

It is a small thing, but boards set the emotional weather. A board that can say "we are in good shape" when it is true makes its serious moments land harder when they come.

Frequently asked questions

Should the board meet between the holidays?

Only for a genuine emergency. A routine meeting in the quiet week signals that rest is not actually sanctioned, whatever the calendar says.

What if something does come up?

That is what the on-call list and the escalation path are for. One named person decides whether it can wait, and almost everything can.

Is a year-end thank-you message appropriate?

Yes, and keep it short. Gratitude without a request attached is rare enough that people notice it.

A practical next step

Let the week be quiet, and check that the on-call list and daily glance are the only technology obligations anyone carries into it. If the quiet feels uneasy because you are not sure those exist, book a Decision-Clarity Call for early January.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Board Cyber Oversight

All CISO Insights
Board Cyber Oversight

When a Cyber Risk Exception Should Expire

A cyber risk exception without an expiry date is an unrecorded acceptance of risk. Learn when exceptions should expire, renew, or escalate to the board.

Board Cyber Oversight

Year-End Cyber Review: The Six Slides That Matter

A year-end cyber review should set next year's risk decisions, not recap this year's activity. Six slides carry the whole story, end to end.