The change freeze exists to protect production from well-meaning engineers. It also removes the people who understand your backup estate at exactly the moment attackers and hardware failures are most likely to test it. Q4 recovery planning is therefore a staffing problem as much as a technical one: the question is not whether your backups work, but whether the person on call at 2 a.m. on a holiday can restore from them without calling the one engineer who is on a plane.
Why holidays are a recovery risk
The pattern is documented by government and by industry survey data. In August 2021, the FBI and CISA published joint advisory AA21-243A, noting an increase in highly impactful ransomware attacks occurring on holidays and weekends when offices are normally closed. The advisory observed that the timing gives attackers a head start because defenders and IT support are at limited capacity for an extended period, and it listed making an offline backup of your data among its recommended actions.
Survey data points the same way. Semperis’s 2025 ransomware study reported that 52% of surveyed organizations across ten countries were targeted at holidays or weekends, and that 78% of companies cut security operations staffing by half or more during those periods, with 6% cutting it entirely. An earlier 2024 Semperis report covering the U.S., UK, France, and Germany put the share attacked on a holiday or weekend at 86%. The surveys differ in scope, so treat the figures as indicators of direction rather than a precise rate, but the staffing numbers are the relevant ones here: reduced coverage is the norm, and it is chosen.
Before the freeze: verify, don’t assume
Run the following during the two weeks before the freeze begins, while the full team is still available to fix what turns up.
- Restore one real workload, end to end. Pick a business-critical system, restore it to an isolated network, and confirm the application starts and the data is current. A green backup job proves only that data was written.
- Check the last successful job per system. List every protected workload with its last successful backup time. Anything silently failing since October is a finding.
- Confirm retention covers the freeze. If your shortest retention tier is 14 days and the freeze runs 21, you are choosing to overwrite the last known-good point from before the freeze.
- Verify the isolated copy. Confirm that your immutable, offline, or logically air-gapped copy exists, was written recently, and is not reachable with the credentials a compromised domain admin would hold.
- Test the break-glass credentials. Backup console admin accounts, hypervisor root, and cloud recovery accounts should work, be stored where the on-call person can reach them, and be rotated after the holiday, not before.
- Check capacity. Repositories that fill up fail silently. Look at free space and growth trend now, and note which jobs a full repository would stop first.
- Confirm alert routing. Send a test alert from the backup platform to the on-call channel. If it goes to a mailbox belonging to someone on leave, fix that today.
Skeleton-crew runbooks: write for the least familiar responder
A runbook that assumes the author is on the call is not a runbook. Write for a competent engineer who has never touched this backup platform, and test it by having someone outside the backup team execute it.
Make each runbook a single page per scenario. Cover the scenarios that actually cause holiday incidents: a single server failure, a failed storage array, a suspected ransomware event, a lost cloud account or tenant, and a failed backup repository. Each page should open with the decision it supports, the evidence that tells you which scenario you are in, and the first three actions.
Write down who may decide what. Slow recovery is often an authority problem. Spell out who can declare a disaster, who can approve taking a system offline, who can authorize restoring over production versus to a side-by-side environment, and who can engage external responders or the cyber insurer. Include phone numbers and the order to call them, in a printed form that does not depend on the systems that might be down.
Pin the recovery order. List systems in the sequence they must come back, typically identity and DNS first, then the backup platform itself, then data-tier and application systems. Record each system’s recovery time objective, so the on-call person is not choosing priorities under pressure.
Preserve evidence before restoring. If compromise is suspected, the first action is to isolate and capture, not to restore over the affected systems. Say so in the runbook. Restoring too quickly can destroy forensic evidence and reintroduce the same compromise from an infected recovery point.
State the stop conditions. Tell the responder when to stop and escalate: if a restore fails twice, if recovery points predate the incident window, or if the backup console itself appears compromised.
During the freeze: keep the checks cheap
Hold a short daily review of backup job success, repository capacity, and alert health, even if each check takes minutes, and assign it to a named person per day rather than the team in general. Define in advance which backup job failures page someone immediately and which wait until morning. Leave a single shared document listing open issues so that a handoff between on-call staff loses nothing.
Freeze policy should also state what is exempt. Backup changes made to fix a failing job should not require the same approval path as an application release, or the freeze will convert a small, fixable fault into a silent multi-day gap.
After the freeze: close the loop
Rotate the break-glass credentials that were used or exposed. Review every alert and manual intervention, and fold what the skeleton crew had to improvise back into the runbooks. Record how long the first-responder steps actually took, and use that to update your recovery time estimates for the next holiday, rather than for the plan on paper.
The practical test for all of this is simple. Pick one runbook before the freeze, hand it to someone who has never used it, and have them restore a non-critical system while you watch silently. Every question they ask is a line to add before the holidays start.