At a glance
Before a Christmas shutdown, confirm support arrangements, test phone routing, review access, finish planned updates and check backups and alerts. Give payment approvals a clear verification process. On reopening, review alerts, recovery records and holiday settings before the team returns to normal work.
A Christmas shutdown IT checklist
The last week before Christmas fills quickly. Staff are finishing jobs, clients need answers and someone still has to organise the close-down. A short IT checklist helps you leave with fewer loose ends and gives the first morning back a better chance of running smoothly.
Give each item an owner and a completion date. If you have several offices or a site that keeps operating, record the arrangements for each location rather than assuming one shutdown plan fits everyone.
1 Confirm who can help over the break
Agree who handles urgent business decisions and where staff can find their contact details if email is unavailable. Confirm your provider’s holiday hours, escalation process and any support arrangements that apply to your agreement.
Keep Cicom’s support contact and 1300 324 266 in the team’s approved contact list. Check holiday arrangements directly before relying on them. Add insurer, broker and key supplier details to your incident response plan.
2 Test calls and out of office messages
Record accurate closing and reopening dates and a useful next step for customers. Keep personal leave details out of public messages. Review shared inboxes as well as individual email accounts.
If you use cloud phones, test diversions, holiday schedules and voicemail from an external number. Check that the person receiving urgent calls has agreed to the arrangement. Make a note of who removes the settings on reopening.
3 Review digital and building access
Remove access that should have ended when staff or suppliers left. Check keys, access cards and alarm contacts with the person responsible for the building. Confirm cameras are recording and that authorised people can receive relevant alerts.
For systems, review remote access, administrator accounts and security monitoring. Holiday leave does not require permanent accounts to be removed, but access should still match each person’s role.
4 Finish planned updates with time to test
Arrange updates early enough to restart and check systems before staff leave. Follow vendor requirements for business applications and operational equipment. Do not introduce a major change on the last afternoon without a recovery plan.
ASD’s fundamental security controls guidance covers the role of updates, account protection and backups. Agree with your provider which devices need to remain on for maintenance, monitoring or scheduled work.
5 Check backups and the person watching alerts
Review recent backup results, the data being protected and a suitable restore test. Confirm that storage capacity and access arrangements will remain adequate through the break. Backup and data recovery needs a clear owner while the office is quiet.
ASD’s business and customer data guidance is a useful reference for protecting information and recovery copies. A successful backup does not establish that every critical application can be restored within the time the business needs.
Decide who receives a failed-backup or security alert, what they do with it and who takes over if they are unavailable. A monitored mailbox is only useful if the nominated person is actually checking it.
6 Keep payment checks in place
Changed routines can make unusual requests harder to verify. Give the team a clear rule: a bank-detail change needs a check through a trusted channel before payment. This applies even when the email appears to come from a familiar supplier or senior colleague.
Scamwatch’s business email compromise advice explains the risk of payment redirection. Call using a number already held in trusted records or obtained independently, not contact details supplied in the change request.
Confirm who can approve payments over the break and what happens if that person cannot be reached. Build this into staff cyber security practices so the rule continues after January.
On the first morning back
- Review security and backup alerts, and confirm who followed up any issues.
- Check critical applications and allow devices to complete required updates.
- Verify unexpected payment or supplier-detail changes before acting.
- Remove holiday call routing and out of office messages at the agreed time.
- Record unresolved problems and give each one an owner.
If something looks suspicious, stop the affected activity and contact your IT provider promptly. Use your incident plan to guide reporting and escalation rather than experimenting with fixes that could lose evidence.
Make the close down a shared task
A calm shutdown depends on a few clear decisions, followed through by the right people. Keep the checklist with your wider IT governance records, and use our connectivity guide if a site will operate with reduced staff.
Speak to the Cicom team before you shut down or call 1300 324 266 to discuss the IT checks that need attention. Agree a time before your final working week so there is room to act.