IT Change Freeze: What to Fix Before the Holidays

Most organisations head into the holidays with a change freeze, a skeleton crew and dashboards that look healthy. The work that matters in the weeks before is not more change. It is making sure someone will see a problem, act on it and recover from it.

Key Takeaways

An IT change freeze protects stability, but it also locks in every visibility gap that exists on the day it starts. The weeks before the freeze are the last chance to close them.
Monitoring is only as good as the person who receives the alert. Over the holidays, alert routing, on-call rosters and escalation paths matter most, and they are the controls least often tested.
A backup report is not a recovery. Restore something the business depends on before the freeze, while the people who know how are still at their desks.
Suppliers and service providers run reduced rosters too, and for retail and logistics, peak load lands on top of all of it.

Picture the first working Monday of January. An infrastructure manager finds an alert sitting in a shared mailbox. It fired at 2.14am on 27 December, a week into the IT change freeze. A storage array had started logging errors on the volume behind the warehouse management system. The paging rule that should have woken someone still pointed at an engineer who left in October. Nothing else flagged it. The array kept serving data and every dashboard stayed healthy. The errors grew until the system slowed to a crawl on the first day of the post-Christmas returns rush.

None of this is exotic, and that is the point. From early December to mid-January, most organisations can see less than at any other time of year. Change is locked down, teams are thin and suppliers are on leave. Attackers and peak trading do not keep the same calendar. What you can’t see before the freeze, you will live with until February.

An IT Change Freeze Keeps the Gaps It Starts With

A change freeze is the right call. In Orro’s experience, most large Australian organisations stop non-essential production changes in early December and run reduced staffing through to mid-January. The reasoning is sound: changes made by tired teams in a quiet period are a reliable way to break things that were working.

The trade-off is that a freeze preserves whatever exists on the day it begins. A missing monitoring rule stays missing. An alert routed to the wrong person stays misrouted. A dependency nobody mapped stays unmapped. Those gaps rarely get fixed during the freeze, because fixing them is change.

That makes the weeks before the freeze the window that counts. The work is not another project. It is confirming that you will see a problem, that someone will act on it and that you can recover. Every change freeze still needs an exception path for genuine emergencies. Orro’s companion piece Eight Hours Was Optimistic explains why that path has to be agreed before it is needed.

An Alert Nobody Receives Is Not Monitoring

Monitoring has two halves. One detects the problem. The other puts it in front of someone who can act. Over the holidays, the second half is where things break, and it is the half least often tested.

The weak points are familiar. Alerts land in shared mailboxes nobody opens over the break. On-call rosters list people who have changed roles. Paging integrations were configured years ago and never retested after a platform upgrade. The business owner of a critical system is on leave with no named delegate.

The fix is a test, not a document review. Trigger a real alert from each critical system and follow it end to end. Note where it lands, who acknowledges it, how long that takes and who they call at 2am on a public holiday. CISA and the FBI recommend that organisations keep actively monitoring over holidays and weekends and name IT security staff to be on call (CISA and FBI, 2021).

A Backup Report Is Not a Recovery

A clean backup report tells you the job ran. It does not prove the data can be restored, or how long that takes. Nor does it show whether the people who know the procedure will be around when it is needed.

ASD’s Essential Eight treats restore testing as baseline practice. Even at Maturity Level One, it expects restoration of data, applications and settings from backups to be tested as part of disaster recovery exercises (ASD’s ACSC, n.d.). Attackers have noticed the gap between holding backups and using them. Increasingly, they go after recovery first, as Orro set out in The Recovery-Denial Economy. The holidays add a practical risk: CISA and the FBI advise organisations to review backup schedules for the chance that holiday disruption interrupts them (CISA and FBI, 2021).

Before the change freeze, pick one system the business genuinely depends on and restore it to a test environment. An order database, a clinical system or the warehouse management platform are all good candidates. Time it. Note who had to be involved and what documentation they needed. If the restore depends on one person who goes on leave on 19 December, that is the finding.

Evidence Snapshot

On holiday timing

Over one US holiday weekend in 2021, a ransomware attack on a food sector company halted meat production at facilities in the US and Australia (CISA and FBI, 2021)

On peak load

Australian retailers expect Click Frenzy, Black Friday and Cyber Monday to deliver 52% of their holiday revenue (Deloitte, 2026)
Australia Post delivered almost 111 million parcels over the 2025 peak, with more than 3.3 million on its busiest day (Australia Post, cited in Deloitte, 2026)

On automated attack traffic

More than 1.57 million login accounts tied to major e-commerce sites were collected from stealer logs in the three months before the 2025 holiday season (FortiGuard Labs, cited in iTWire, 2025)

Your Suppliers Take Holidays Too

Very little runs on infrastructure an organisation fully controls. Cloud platforms, carriers, service providers and logistics partners all run reduced rosters over the break. Their gaps become yours.

Before the freeze, list the third parties each critical service depends on. For each one, confirm their holiday coverage and how to reach someone with authority to act. Then check what they need from you to raise a priority incident. Keep those contacts somewhere that does not depend on the systems they support.

For some organisations the question reaches well beyond IT. An aged care provider cannot stop feeding residents or ordering medication because a system is down. Its continuity plan rests on whether its suppliers can still take a manual order and deliver against it. That is worth confirming with them in November, rather than discovering on Boxing Day.

Peak Load Meets a Skeleton Crew

For retail, transport and logistics, the holiday window is also the busiest of the year. Retailers expect Click Frenzy, Black Friday and Cyber Monday to deliver around half of their holiday revenue (Deloitte, 2026). Over the last peak, Australia Post delivered almost 111 million parcels, with more than 3.3 million on its busiest day in early December (Australia Post, cited in Deloitte, 2026). The heaviest load arrives just as staffing starts to thin.

Peak tests the whole chain, not just the website. Point of sale, inventory, warehouse systems and last-mile delivery all have to keep pace with each other. When the link between storefront and warehouse congests, stock data lags and a retailer can sell what it no longer has. Load-testing those integration paths, not only the web front end, finds that before customers do.

Automated attack traffic rises alongside legitimate demand. Before the 2025 holidays, FortiGuard Labs found more than 1.57 million login accounts tied to major e-commerce sites circulating in stealer logs, fuelling credential stuffing and account takeover (FortiGuard Labs, cited in iTWire, 2025). Rate limiting and anomaly detection on login and checkout are practical controls. Confirm they are in place while there is still time to tune them.

Inside distribution centres, the constraint is often wireless. Handheld scanners that drop out in coverage dead zones slow picking and introduce errors exactly when volumes peak. A wireless survey before peak finds them. At a major sporting event, handheld scanners lost connectivity on congested public networks under crowd load, and a dedicated network solved it. A distribution centre at peak is the same problem with pallets instead of spectators.

Retail teams working on store networks, payment terminals and in-store wireless threats will find those covered in The Secure Checkout Checklist.

Book January Before the Change Freeze Starts

The last step is the easiest to skip. Put the post-peak review in diaries now for mid-January. Invite the people who were on call, the owners of critical services and the key suppliers. Ask each team to keep a short log through the change freeze. Record what alerted, what didn’t, what was slow to reach the right person and what was fixed by hand. Lessons captured while they are fresh shape the next change window. Lessons reconstructed in March rarely do.

Make Quiet Mean Something

The dashboards will probably stay healthy over Christmas. That is only reassuring if someone is watching them, and if they would show a problem when one occurs. Neither is guaranteed with a skeleton crew on duty. Both can be checked in the weeks before the freeze. That is where this edition’s theme turns practical. Past the green light sits a person who sees the alert, a supplier who answers and a restore already proven to work.

Before the freeze: five checks

Fire a test alert from each critical system and confirm a named person acknowledges it.
Check on-call rosters, delegates and escalation contacts against who will actually be available.
Restore one business-critical system to a test environment and time it.
Confirm holiday coverage and priority contacts for every critical supplier and carrier.
Book the post-peak review for mid-January.

Hand your operations lead the full list

The five checks above are the start. Orro’s Before the Freeze checklist takes them further across every sector, covering restore testing, alert routing and on-call, supplier holiday coverage, peak-load capacity, distribution centre wireless and holiday-period access reviews. It is built to be worked through in the weeks between now and the freeze.

GET THE BEFORE THE FREEZE CHECKLIST

Retail? For store networks, payment terminals and in-store wireless, see The Secure Checkout Checklist.

IT Change Freeze: Common Questions

What is an IT change freeze?

An IT change freeze is a period when non-essential changes to production systems are paused, with only approved emergency changes allowed. Many large Australian organisations run one from early December to mid-January, to protect stability through peak trading and reduced holiday staffing.

What should IT teams do before a change freeze?

Focus on visibility and recovery rather than new projects. Test alert routing end to end, check on-call rosters and escalation contacts, restore a business-critical system to prove recovery works, confirm suppliers’ holiday coverage and contacts, and book the post-peak review for January.

Why is the holiday period a higher cyber security risk?

Staffing is reduced, response is slower and attention is elsewhere. CISA and the FBI have warned that attackers may view holidays and weekends as attractive times to strike because defenders and IT support are at limited capacity.

How often should backup restoration be tested?

ASD’s Essential Eight expects restoration from backups to be tested as part of disaster recovery exercises at every maturity level. Before a change freeze, restore at least one system the business depends on and time how long it takes.

How should retailers and logistics operators prepare for peak?

Load-test the whole chain from storefront to warehouse and last-mile delivery, not just the website. Confirm rate limiting and anomaly detection on login and checkout, and survey wireless coverage in distribution centres before volumes rise.