The Quiet Fortnight: What to Check Before Your UK Office Empties for Christmas

Christmas is coming, and for many UK small firms that means a strange mix of frantic invoicing and sudden silence. The office empties, the phones divert, and everyone promises to ignore email until January. That quiet fortnight is exactly when a lot of avoidable IT incidents settle in. Attackers do not observe the bank holidays. Automated scans keep running, phishing emails keep arriving, and a forgotten remote-access account does not know it is Boxing Day.

This is not a scare story. It is a simple argument for spending the last 48 working hours before the 2026 Christmas break on a short, practical shutdown routine. Think of it as intercepting the predictable New Year disaster before it has a chance to happen.

A quiet office is not a closed door

Most small-business security advice assumes someone is watching. Over Christmas, nobody is. That changes the risk. A suspicious login on a Tuesday morning might get noticed. The same login on 27 December can sit in a log until the first week of January. A failed backup might be visible for a day or two, then forgotten. An email forwarding rule can quietly copy invoices to an outside address for a fortnight.

The goal is not to turn your firm into a bank. It is to close the obvious gaps, prove the important things work, and make sure one named person can act if something goes wrong.

Backups: test the restore, not just the backup

A backup you have never restored is a hope, not a control. Before the break, ask for a test restore of a real file or folder, not a demo. Better still, restore something from the finance share and something from email or Microsoft 365. Note how long it took and who did it.

Check that backups are running now, not just that they ran in October. Look for failed jobs, full disks and warning emails that have been ignored. Confirm where the copies live. If every backup sits on the same network as the servers, ransomware can find it. Keep at least one copy offline or in a separate cloud account with different credentials.

Also check that the person who can restore data is not the only person with the password. Write down the escalation route. If your IT provider holds the keys, confirm their holiday cover in writing.

MFA on remote access and admin accounts

Multi-factor authentication is the seatbelt of small-business IT. It is not perfect, but it stops a huge amount of opportunistic login abuse. Before you lock up, check that MFA is switched on for remote access, email, cloud admin accounts, finance systems and any tool that can change money or move data.

Then look for exceptions. Old test accounts. Shared admin logins. A contractor who left in the summer. An accounts-payable mailbox with a password that has not changed for years. Disable what is not needed. If you use SMS codes, consider an authenticator app for admin accounts. If you use a password manager, make sure the emergency access process is documented and stored securely.

Patch, reboot and tidy the digital hallway

Install the updates you have been deferring. That includes Windows and macOS, browsers, phone firmware, and the plug-ins nobody thinks about. Reboot the machines. A patch that is downloaded but not applied is just a notification.

While you are there, clear out stale accounts and old shared folders. Remove former employees from email groups and cloud drives. Check antivirus and endpoint protection is reporting correctly. Make sure the person covering the break knows what a real alert looks like, so they do not dismiss it as a Christmas lights glitch.

Email forwarding rules and out-of-office replies

Hidden inbox rules are a favourite trick because they are quiet. Check for forwarding rules, delegates and mailbox permissions on key accounts, especially finance, sales and the managing director. Look for rules that delete, redirect or mark messages as read. If you find one nobody recognises, treat it as a security incident, not a tidying job.

Out-of-office messages should be useful but not a burglar's guide. Say when you are back and who to contact. Do not publish the exact dates the office is empty, the name of the alarm company or a full list of staff mobile numbers.

Phones, diversions and payment approvals

Test the phone diversion before you rely on it. Call the main number from a mobile and see where it lands. Update voicemail greetings. If an answering service takes messages, confirm their holiday hours and escalation process. Give key clients a route that works.

Money is the other seasonal risk. Make sure urgent payment requests over the break require a second approval. Agree now that bank detail changes will not be accepted by email alone. A short delay is annoying. A fraudulent payment is worse.

Name an on-call human, and a backup human

'Email support' is not an on-call plan. Name one person who will answer the phone, and one person behind them. Give both the authority to act. Share the contact details with whoever is opening the office in January. Test the number before you leave. If your IT provider promises 24/7 cover, ask how a small firm actually reaches that cover, and what happens on a bank holiday.

The 48-hour shutdown checklist

Use the last two working days for a short, focused sweep.

• Day one: test a restore, check backup job status, confirm offsite copies and write down who can restore.
• Day one: switch on and verify MFA for remote access, email and admin accounts. Disable leavers and unused logins.
• Day two: apply outstanding patches, reboot, and check endpoint protection reports.
• Day two: audit email forwarding rules and delegates. Set safe out-of-office replies.
• Day two: test phone diversions, update voicemail, and confirm payment approval rules.
• Before you leave: send the on-call sheet to the named contacts and keep a copy somewhere secure but accessible.

Leave a one-page shutdown sheet

Keep it simple. List the main IT contacts, the internet provider, key cloud services, backup status, the on-call rota and the escalation route. Do not put passwords in it. Store it where the on-call person can reach it without breaking into the office.

When everyone returns in January, do a short review. Did the backups run? Did anyone try to log in from an odd location? Did the phone diversion work? The point is not to create paperwork. It is to make the quiet weeks less useful to the wrong people.

A Christmas shutdown should be a rest, not a gamble. Spend 48 hours intercepting the obvious problems, and you can start 2027 with a clean desk rather than an incident response call.