Christmas Shutdown IT Checklist for Small Businesses (2026)
2 November 2026 · By Ethan Fernandes
What to check before your office closes for Christmas: updates, backups, renewals, invoice fraud, out-of-office messages, who to call over the break, and what to do on the first day back.
Quick answer
Before closing for Christmas, install December's security updates and restart every device, test a backup restore, check domains, certificates and licences won't expire, remove leavers and confirm MFA, verify bank detail changes by phone, set safe out-of-office messages and agree who to call. Update everything again on the first day back.
The Christmas break is the longest stretch most small businesses leave their systems unattended all year. Nobody is watching the inbox, laptops sit switched off for two weeks, and the first day back is spent on updates, forgotten passwords and the MFA prompt on a phone that was replaced on Christmas Day. Criminals know it too: payment fraud and phishing rise when offices are quiet and staff are distracted.
A couple of hours in early December avoids almost all of it. Here's the checklist we work through with our clients.
The short version: before you close, install December's updates and restart every device, test a backup restore, check nothing expires over the break, lock down payment changes, set sensible out-of-office messages and agree who to call if something goes wrong. On the first day back, update everything again before anyone starts work.
Two Weeks Before You Close
1. Install December's updates, then restart
Microsoft releases its monthly security updates on the second Tuesday of the month, which is 8 December 2026. Make sure every Windows and Mac laptop has installed them and actually restarted before the break, along with browsers, Microsoft 365 apps and any line-of-business software. A laptop left unpatched for a month is an easy target the moment it reconnects in January.
2. Update the router, firewall and Wi-Fi
Check for firmware updates on your firewall, router and access points, and make sure remote management isn't exposed to the internet. If you're not sure, our free security review checks what your business exposes from the outside.
3. Test a backup restore
Don't just check the backup ran: restore a real file and open it. Confirm that Microsoft 365 or Google Workspace data (email, OneDrive, SharePoint and shared drives) is backed up as well as any server or NAS. See why OneDrive on its own isn't a backup.
4. Check nothing expires over the break
- Domain name renewals and website SSL certificates
- Microsoft 365 or Google Workspace subscriptions on annual renewal
- Antivirus, backup and firewall licences
- Payment cards saved against any of these, in case one has expired
An expired domain over Christmas means no email and no website until someone notices.
5. Tidy up accounts
Remove anyone who has left, make sure every account has multi-factor authentication, and check that at least two people can sign in as an administrator. If the only admin is on holiday with their phone switched off, nobody can unlock an account.
Protect Your Payments
The weeks before Christmas are a peak time for invoice and payment diversion fraud: an email that appears to come from a supplier, or from the boss, asks for bank details to be changed or an urgent payment to be made before the break.
- Verify every change of bank details by phone, using a number you already hold, never the one in the email.
- Agree that payments over a set amount need two people to approve them, especially while staff are away.
- Pay suppliers before the break where you can, so there's less pressure to pay urgently while the office is closed.
- Remind the team what a convincing phishing email looks like. See how to spot a phishing email.
Out-of-Office Messages That Don't Help Criminals
- Say when you're back, not that the office is empty.
- Give a shared contact address such as info@, not personal mobile numbers.
- Avoid naming who handles payments or who is covering for whom.
- Use a shorter message for external senders than for colleagues. Outlook and Gmail both let you set them separately.
Before You Lock the Door
- Leave on anything that needs to stay running: servers, the router and firewall, the backup device, CCTV, alarms and phone systems.
- Switch off desktop PCs, printers and screens that won't be used.
- Take laptops home only if people will use them, with their chargers, and make sure they're encrypted.
- Check anything that uses a phone line, such as alarms, lift lines and card machines. The copper landline network finishes switching off by 31 January 2027, so the break is a good time to plan. See our business landline switch-off guide.
During the Break: Who Do You Call?
Write down, and share with key staff, who to contact if something goes wrong: your IT provider's support details, your Microsoft 365 admin, your bank's fraud line and your cyber insurer's incident number if you have one.
First Day Back in January
- Start every laptop early and let updates install before people need them.
- Expect MFA problems from anyone who got a new phone for Christmas. Microsoft Authenticator doesn't always move across on its own. See what to do when Authenticator is on an old phone.
- Check new personal devices against your rules before they're used for work email.
- Look through the shared inbox for anything suspicious that arrived over the break, especially payment requests.
- Confirm last night's backup ran.
How We Handle It
For our managed IT clients, we run a pre-Christmas check: updates, backups, renewals, admin access and out-of-office settings, and we agree with each business how support works over the break. On the first working day back we check devices have updated and help anyone locked out by a new phone. If you'd like the same before this Christmas, see our managed IT support or get in touch.
Related Reading
Common questions
Install December's security updates and restart every device, test a backup restore, check domains, SSL certificates and licences won't expire over the break, remove leavers, make sure MFA is on, verify any bank detail changes by phone, and agree who to call if something goes wrong.
Turn off desktop PCs, printers and screens that won't be used, but leave on servers, the router and firewall, backup devices, CCTV, alarms and phone systems. Make sure laptops have installed their updates and restarted before the break.
Say when you'll be back and give a shared contact address such as info@. Don't say the office is empty, don't list personal mobile numbers, and don't name who handles payments.
Don't switch the affected computer off. Disconnect it from the network, change the affected account's password from another device, contact your IT provider and, if money is involved, your bank's fraud line straight away.
Offices are busy, staff are away and there's pressure to pay suppliers before the break, so fake requests to change bank details or make urgent payments are more likely to get through. Always verify changes by phone using a number you already hold.
Want to talk about this?
Book a free 15-minute call and we'll discuss how this applies to your business.
Get IT tips in your inbox
Practical advice for small businesses. No spam.