Preparing Your Business IT for the Christmas Shutdown

The office closes on a Friday in late December and reopens in the second week of January. For most of that time, the building is empty, the team is on leave and business systems continue running without the usual people around to keep an eye on things.

While Christmas shutdowns provide a welcome opportunity for staff to take a break, they also create some unique IT challenges. Reduced staffing, unattended systems, increased cyber risks and the unpredictable nature of Brisbane’s summer weather all make preparation important.

Most shutdown checklists cover locking the doors and updating antivirus software. But there is more to consider if you want your business to return in January without unexpected IT issues.

Here are some of the things Brisbane businesses should consider before closing for Christmas.

The Risks That Don’t Take a Holiday

One of the biggest considerations is what happens if something goes wrong while your business is closed.

Cybercriminals often take advantage of periods when businesses have fewer staff available to identify and respond to suspicious activity. A compromised account or ransomware incident that might normally be detected quickly could go unnoticed for several days over the Christmas break.

There are also regulatory obligations to consider.

Australia has two important reporting requirements that may apply regardless of whether your office is open.

If your business is subject to the ransomware payment reporting obligations and makes a ransomware payment, or becomes aware that an insurer or incident response provider has made one on its behalf, the relevant reporting requirement is generally within 72 hours to the Australian Signals Directorate.

If personal information is involved in a data breach, the Notifiable Data Breaches scheme requires organisations to conduct a reasonable assessment within 30 days of becoming aware of suspected eligible data breaches and, where an eligible breach is identified, notify the OAIC and affected individuals.

Consider a scenario where an incident begins on 27 December but isn’t discovered until 5 January. Several days have already passed before anyone realises there is a problem.

There is also a commercial consideration. Cyber insurance policies often have specific incident notification requirements, and delays in reporting an incident could affect your ability to make a claim.

We have covered these obligations in more detail in our guides to ransomware payment reporting and the Privacy Act changes.

The important thing is to establish who is responsible for monitoring, who should be contacted if an incident occurs and who has authority to make decisions while the business is closed.

The Question to Ask Your IT Provider This Month

Most managed IT agreements include some form of monitoring, but it’s worth understanding exactly what that means during a Christmas shutdown.

There is a difference between automated alerting, where notifications are generated but human response occurs during normal support hours, and a service that includes staffed after-hours incident response.

Both are legitimate service arrangements, but they provide different levels of coverage.

Before closing for Christmas, ask your IT provider:

• Over the shutdown, is monitoring automated or staffed, and what happens if a critical alert is generated?
• Who from your team is contactable, on what number, and what is the escalation process?
• Who at our end are you authorised to take instructions from, and what actions can be taken without waiting for approval?

That last question is particularly important. If a critical incident occurs and your IT provider cannot reach anyone authorised to make decisions, the response may be delayed.

Agree on a decision-making process before everyone leaves, including who can authorise expenditure and who the backup contact is if the primary contact is unavailable.

Before the Office Closes

A little preparation before the Christmas break can help prevent a lot of unnecessary disruption when everyone returns.

Patch, then reboot, then check. Apply outstanding updates in the week before shutdown rather than leaving them until the last day. This allows time to identify and resolve any issues. Confirm devices have actually restarted and that updates have been successfully installed.

Verify your backups by restoring something. A backup job reporting success doesn’t necessarily mean your data can be recovered. Test a restore of an actual file, ideally a larger file, and confirm it opens correctly. Regular restore testing is one of the most important parts of a reliable backup strategy.

Confirm your backups are protected. If ransomware compromises an administrator account, could it also access or delete your backups? Immutable or appropriately separated backups can make a significant difference to your ability to recover from an incident.

Clean up accounts. Disable accounts belonging to former employees and review contractor and temporary access. Seasonal staff and Christmas casuals should have access that expires when it’s no longer required.

Check MFA coverage properly. Don’t just confirm that multi-factor authentication is enabled. Review whether any accounts can bypass it, including service accounts, legacy authentication protocols and exemptions that may have been granted for convenience.

Think about out-of-office messages. An automatic reply saying “I’m away until 12 January, please contact Sarah in accounts for anything urgent” can reveal useful information to someone attempting invoice fraud or a targeted phishing attack. Keep external automatic replies relatively general. Avoid sharing unnecessary staff names, dates and internal contact arrangements.

Brief anyone handling payments. Invoice fraud can become more difficult to detect when normal approval processes are disrupted and people are working remotely or covering unfamiliar responsibilities. Make it clear that any changes to supplier payment details must be independently verified using a previously known phone number. This should apply even when the request appears to come from a director or senior manager.

The Brisbane Part: Storm Season

Every Christmas shutdown article should consider the local environment, and for Brisbane businesses that means storm season.

Storm season in South East Queensland generally runs from November through April, and the Christmas shutdown falls right in the middle of it. Severe storms, power outages and flooding can all affect business operations.

An unattended office is particularly vulnerable if something goes wrong with power, cooling or connectivity.

Practical items worth checking include:

• UPS batteries: Confirm your UPS batteries are still holding charge. They typically need replacing every three to five years, depending on usage and conditions. An untested UPS may not provide the protection you expect.
• Comms room cooling: Check what happens if air conditioning is switched off or fails during the shutdown. Network equipment and servers can overheat quickly in Brisbane’s summer conditions.
• Internet failover: Understand what happens if your primary internet connection drops out and whether anyone will be notified.
• Flood protection: If your premises are in a flood-prone area, make sure important IT equipment isn’t sitting on the floor of the comms room.
• Physical access: Confirm someone local can attend the building if required and has the necessary access arrangements.

Moving more of your IT environment to the cloud can reduce reliance on physical infrastructure at your premises. However, cloud services still need appropriate security, backup and monitoring arrangements, and many businesses retain some on-premises equipment.

It’s worth reviewing what you have, how it’s protected and what would happen if your premises lost power or connectivity for an extended period.

One Thing Worth Doing This Year Specifically

Microsoft is retiring its built-in SMS and voice multi-factor authentication services, with changes taking effect from February 2027.

Businesses relying on text messages or phone calls as their primary MFA method should start planning the transition to alternative authentication methods.

The Christmas shutdown is a good opportunity to identify which users and accounts are still relying on these methods and plan the change before it becomes an issue.

Our article on Microsoft retiring SMS and voice MFA explains what’s changing and what businesses need to do.

If Anyone Is Working

Some businesses continue operating with a skeleton crew over Christmas and New Year. This creates its own set of considerations, particularly when normal support and approval processes aren’t available.

Make sure anyone working over the break knows who to contact if something goes wrong and has the correct contact details.

Confirm remote access is working before the office closes rather than waiting until someone needs it. Also, remind staff that normal security practices still apply, even when they’re working alone or outside normal business hours.

Phishing emails, suspicious links and unusual payment requests don’t become less risky just because fewer people are around.

The First Day Back

The first day back is about more than catching up on emails. It’s also an opportunity to check that everything has continued operating as expected while the business was closed.

Devices that have been switched off for several weeks may have outstanding updates, expired passwords or other issues that need attention. Allow some time for systems to reconnect, update and settle before scheduling anything critical.

It’s also worth reviewing what happened during the shutdown period, including:

• Security alerts and incidents generated during the closure.
• Unusual sign-in activity or access from unexpected locations.
• New or modified mailbox forwarding rules.
• Suspicious emails and items sitting in quarantine.
• Backup reports and any failed backup jobs.
• Connectivity, server or infrastructure alerts.

A mailbox rule quietly forwarding invoices to an external address, for example, may have been created during the break and gone unnoticed.

Remind staff to take care when working through their accumulated emails. A phishing email received on 28 December may still be sitting in their inbox when they return, and it can be easy to overlook something suspicious when trying to catch up quickly.

What Your IT Provider Should Be Doing Without Being Asked

A well-managed IT environment shouldn’t rely on someone remembering to check everything before Christmas.

Much of the preparation should form part of your ongoing IT management, including:

• Outstanding security updates and patching completed before closure.
• Backup jobs monitored and recovery verified through restore testing.
• Security monitoring and alert escalation arrangements confirmed.
• Clear support contacts and documented escalation procedures.
• Critical infrastructure, connectivity and backup arrangements reviewed.
• A review of the closure period to identify any issues requiring attention.

It’s also important to understand what your IT provider’s service actually covers during the shutdown. Monitoring, automated alerts and after-hours support are not necessarily the same thing.

If you haven’t heard from your provider about Christmas arrangements by late November, it’s worth starting the conversation.

Frequently Asked Questions

Why are cyber attacks more common over the holidays?

Cybercriminals can take advantage of reduced staffing and slower response times during weekends and public holidays. An incident that might normally be identified and investigated quickly can go unnoticed for several days when a business is closed.

Do data breach reporting obligations still apply during a shutdown?

Yes. Applicable ransomware payment reporting obligations and the Notifiable Data Breaches scheme continue to operate during public holidays and business closures. Businesses should have a process for identifying, escalating and responding to potential incidents.

Should we shut down servers over the break?

Usually not, particularly if systems are required for remote access, business applications or ongoing monitoring. A better approach is to ensure systems are patched, backups are verified and the physical environment, including power, cooling and connectivity, is prepared for the closure period.

What should we tell staff before they leave?

Make sure staff know who to contact if something goes wrong, that normal security practices still apply and that changes to supplier payment details must always be independently verified. A short briefing before the break can help reinforce these expectations.

Is it safe to leave laptops in the office?

Ideally, laptops should be secured out of sight in a locked location. Also confirm that device encryption is enabled so that a lost or stolen laptop doesn’t automatically expose the information stored on it.

When should we start planning the shutdown?

Early to mid-November is a good time to start. Patching, backup verification, access reviews and any required changes to IT arrangements all need time to be completed and tested before the office closes.

A Better Start to the New Year

A smooth return to work in January starts with the right preparation in December.

IT shouldn’t be something you only think about when something goes wrong. From cybersecurity and backup management to infrastructure, Microsoft 365 and business continuity, having the right IT strategy in place helps ensure your business is ready for whatever the new year brings.

It’s also a good time to look beyond day-to-day IT support. Consider whether your technology is keeping pace with your business, where AI and automation could improve productivity, and whether your IT provider is helping you plan ahead.

With the right technology partner, your IT should do more than simply keep the lights on. It should help your business operate more efficiently, manage risk and prepare for what’s next.

Start the New Year with Confidence

Whether it’s reviewing your cybersecurity, improving your IT environment or exploring how AI can help your business work smarter, having the right technology partner makes a difference.

Talk to TechPath about your IT plans for the year ahead.

Read more about TechPath Managed IT Services.