Christmas Cyber Security: A Practical Checklist for Businesses

Christmas can create the conditions attackers like: reduced staffing, unfamiliar devices, urgent payment requests and people working outside their usual routine. A short preparation exercise before the office closes can prevent a small issue becoming a long outage.

Before the holiday period

• Confirm who is on call and how colleagues should report an urgent problem.
• Check that monitoring, alerting and supplier escalation routes are current.
• Verify backups have completed and perform a restore test for critical data.
• Apply approved security updates and avoid unnecessary last-minute changes.
• Review administrator access and disable accounts that are no longer needed.
• Check certificate, domain, licence and subscription expiry dates.

Expect seasonal phishing

Delivery notifications, invoices, payroll changes, refunds and e-cards provide believable cover for phishing. Encourage staff to open supplier and banking websites independently rather than through message links. Payment-detail changes should always be verified using a trusted second channel.

The NCSC maintains practical guidance for spotting and reporting phishing.

Secure temporary and remote working

Require managed devices, multifactor authentication and an approved remote-access route. Avoid public computers and unknown USB devices. If staff must use public Wi-Fi, ensure company services use properly secured connections and prohibit access to sensitive systems from unmanaged devices.

Protect payments and privileged actions

Do not weaken approvals because a decision-maker is away. Define deputies in advance, preserve dual approval for payments and maintain a verified list of supplier contact details. Treat requests that rely on urgency or secrecy as higher risk.

If something goes wrong

1. Record what happened and when.
2. Contact the on-call IT or security lead using the agreed route.
3. Contain affected accounts or devices without destroying evidence.
4. Notify banks immediately if payments are involved.
5. Keep an incident log and provide regular business updates.

Do not wait for the office to reopen if compromise is suspected. Our cyber incident recovery service provides urgent help, while our managed cyber security services help organisations prepare before the holiday period.