The Pre-Holiday Security Checklist: 12 Tasks to Finish Before Your Team Logs Off

The office empties in stages. First the contractors, then the people with long-haul flights, then everyone else, until the week before Christmas when three people are holding the place together with a shared spreadsheet and a coffee machine that only works if you don't touch it. Attackers do not follow the same calendar. Neither do the quieter failures: a certificate that expires on 27 December, a service account nobody owns, a backup job that has been failing since the first week of the month while the dashboard stayed comfortably green.

The window you have before that happens is short. It is better spent working through a list than improvising on a call with two tired people and a patchy mobile connection. Here is what is worth finishing before the lights go out.

Review Access While People Still Remember the Context

Access reviews get skipped in December because they are tedious and because whoever approved the original request is already on leave. Do the parts that matter most.

Start with accounts that should not exist: contractors whose engagements ended in October, interns from the summer, a shared mailbox for a project that closed, an admin account created for a migration and never removed. Disable rather than delete if you need the audit trail, but disable. Then look at accounts with good reasons to exist and far too much power — a monitoring account with domain admin rights, a personal login with production database access.

The ones that always get missed

• Vendor and support accounts with VPN or remote-desktop access
• Service accounts whose owner left two reorganisations ago
• Shared logins for network gear, printers or building systems
• Emergency accounts whose credentials were stored somewhere sensible and then moved

Confirm multi-factor authentication still works for anyone travelling. People change phones and SIM cards on holiday, and a new device is exactly when a hardware token gets left in a desk drawer. Make sure there is a documented way to get someone back in that does not involve switching MFA off for the whole tenant.

A Backup You Have Not Restored Is a Hope, Not a Control

Backup dashboards report what is easy to measure: jobs completed, bytes written, snapshots taken. They rarely tell you whether the data can be recovered by the person who will need it at 3 a.m. on a public holiday.

Pick one system — a file server, a database, a critical SaaS application — and restore something from it. Time it. Then ask the uncomfortable questions:

• Did the restore come from a copy an attacker could not have altered? Immutability and offline copies exist for this reason.
• Are the credentials needed to reach the backup stored somewhere different from the systems being backed up?
• Has the person on call ever run a restore, or only read the runbook?

Check the small things too. Backup console MFA codes and recovery keys should be reachable by someone outside the office, and retention schedules need to survive the shutdown. If a job runs on 25 December against a full storage target, nobody will notice until January.

Patch What Is Urgent, Then Freeze on Purpose

Push the critical patches now, especially anything remotely exploitable on internet-facing systems. The last week of December is the wrong time to roll out a major upgrade to your identity platform, however far behind the project is.

Write down the freeze window and who can approve an exception. An exception needs a second pair of eyes, a rollback plan and a line in the change log — not a message in a group chat that nobody reads until the second week of January. Two lines of documentation beat a heroic overnight rebuild.

Out-of-Office Messages Are a Small Map of Your Gaps

The standard auto-reply is generous to the wrong people. "I am away until 5 January. For urgent invoice approvals, contact Anna Petrova, Head of Finance, on her mobile." That single message tells any sender that approvals are stalled, who is worth impersonating, and which number to target with a convincing text.

Keep replies plain: dates, a monitored group alias, nothing else. Do not name people with approval authority, do not hand out personal mobile numbers, and do not advertise when the payment run happens. Route replies to a mailbox someone actually watches — an alias nobody monitors is worse than silence, because senders assume their message arrived.

While you are in there, confirm that shared mailboxes are not auto-replying to everything, spam included. A loop that answers forged senders confirms your domain is live and keeps your mail server busy all holiday.

Decide Who Answers the Phone

"The security team is on call" is not a plan. Names, numbers, hours, escalation paths. Your alerting platform still holds the number a colleague had two years ago, so test it: fire a test alert and confirm it reaches a human being rather than a dead SIM.

Check that the rota covers the public holidays in every country your team works from. Confirm the on-call engineer can reach the runbooks, the password vault and the ticketing system from home without a corporate VPN that was last tested in September. And confirm they know who has the authority to isolate a machine, take a service offline or declare an incident — decisions that are easy at a desk and much harder at 2 a.m.

A Two-Hour Shutdown Routine

Block two hours in the last week, get two or three people on a call, and work through this. Tick items off out loud; the value is in the confirmation, not the checkbox.

1. Disable accounts with no login in the last 90 days, starting with anything holding administrative rights.
2. Confirm MFA enrolment for everyone working or travelling through January.
3. Restore one critical system from backup and record how long it took.
4. Check free space on log collectors, backup targets and monitoring servers. Full disks stop sending the alerts you rely on.
5. List certificates, domains and licences expiring in the next eight weeks, and renew the ones you can.
6. Call the out-of-hours number from a mobile and see who picks up, and how quickly.
7. Post the on-call contact list somewhere reachable without VPN, and update the printed copy in the server room.
8. Record the change freeze, the approved exceptions and the January review date.

Handover Beats Heroics

Write the one-page handover. Open incidents, known noisy alerts, the two systems most likely to break, and who knows each of them best. Include the details that live only in someone's head: the integration that fails whenever the database restarts, the supplier who only answers email before noon.

Leave that page where a colleague can find it without a laptop and a VPN. Then log off. The aim is not to be reachable over the holidays; it is to make sure the person who is can act without guessing.

Photo: freestocks.org / Pexels