Long-Holiday IT Security Checklist for Small Businesses

Long-holiday security comes down to four things before the break (updates, power-off, backups, emergency contacts), staying alert to suspicious messages and lost devices during it, and restarting work in the right order afterward (updates, mail, logs, restart). When a company shuts down for several days over New Year, the administrator is away and a problem can go unnoticed for a long time. Japan's IPA (Information-technology Promotion Agency) warns every year before long holidays that an incident during the break can delay the response and disrupt business after it. A company without IT staff can keep the workload small by splitting the tasks into three phases and deciding who does what. This article covers why holidays are risky, a checklist for each phase, a role table, rough outsourcing costs, and a short FAQ, written for owners and general-affairs staff.

The problem is less that attacks increase and more that nobody is there to notice for a long time. On a normal working day, someone spots a strange email or a PC acting oddly and speaks up. During a holiday those eyes disappear. IPA also points out that long absences of system administrators create an unusual situation.

- Slow detection: unauthorized access at night or on a holiday goes unseen because nobody checks logs or alerts, so damage can spread until the break ends
- Neglected equipment keeps running: VPN devices, routers, UTMs, NAS units, and servers stay on and exposed to the internet. If a known vulnerability remains, they can be attacked throughout the holiday
- A rush after the break: several days of mail pile up, and the urge to get going makes it easy to open an attachment or URL in a suspicious email that impersonates a real company

IPA's year-end alert for fiscal 2025 (published December 16, 2025) notes that attacks exploiting vulnerabilities and misconfigurations in internet-facing devices continue, and that a device used as a relay point for malicious traffic (ORB, Operational Relay Box) can leak your own data and also make you an unwitting participant in attacks on others.

For the basics of updates and vulnerabilities, see Getting started with patch and update management. This article is the practical follow-up focused on what to do around a long holiday.

Start about a week before the last working day. Updating network equipment on the final afternoon and breaking it with nobody able to fix it is the situation to avoid.

1. Apply OS and software updates. Finish Windows, macOS, browser, and Office updates, including restarts, in the final week. Waiting until after the holiday risks machines that are unusable on the first morning.

2. Check firmware for VPN devices, UTMs, routers, and NAS. Internet-facing devices are probed throughout the break. Check for important vendor updates and apply them beforehand. A failed network update can stop communication for the whole office, so ask your maintenance vendor a few days ahead whether and when to apply it. If you do it yourself, back up the settings first and work in a quiet period. For anything you cannot update, compensate with power-off or closing unnecessary external exposure.

3. Power off equipment you will not use. IPA also asks that servers and other equipment not needed during the holiday be switched off. That can include idle PCs, shared printers, old servers, test equipment, and recorders nobody will check. Some devices must stay on, such as booking systems, monitoring, or scheduled backups. For those, check update status and access restrictions instead. A list of what is switched off and what is not helps.

4. Confirm backups work. Having backups is not enough; confirm that the latest one completed normally. Saving key data manually once more on the last working day gives a clear restore point. Because of ransomware, keep at least one copy not permanently connected to PCs or the NAS. Methods and costs are covered in Data backup methods and costs for small businesses.

5. Confirm the emergency contact structure. IPA asks you to check three points: whether the contact structure and procedures, including contractors, are clear; whether the flow fits the current organization; and whether phone numbers have changed. For a small company, one sheet or phone note that everyone can see is enough.

- Internal contacts during the holiday (first and second), with phone numbers
- Maintenance vendors' holiday contacts and hours (some vendors suspend support during holidays, so confirm in advance)
- The cyber-insurance contact, if you have a policy
- What to do first when something looks wrong (for example, unplug the network cable, do not power off, call the contact)

6. Set rules for devices and data taken out. If anyone will work from home or on the road, confirm which devices and data may leave, where to keep them, and basics such as never leaving them on a train, in a restaurant, or in a car. Add a promise not to put business data on personal PCs or USB drives. The first response to a loss is outlined in What to do when a company PC or smartphone is lost or stolen. Telling people in advance to report a loss even during the holiday is the most effective step.

In principle, the best action is to do nothing special, and keep up normal vigilance even though few people are around. Share these three points with staff.

Do not open suspicious email, SMS, or social media messages. IPA says many suspicious messages impersonating real companies arrive, and urges people not to open attachments or access URLs in them. Typical examples are delivery notices and messages posing as banks, card companies, or shops.

Do not call the number on a fake security warning. Browser warnings claiming a virus infection and pushing you to call a support number (tech support scams) also happen at home during holidays. IPA says warnings displayed in a browser are likely fake and advises closing them, or force-quitting the browser or restarting the PC if they cannot be closed. See Responding to tech support scams (fake virus warnings).

If a device is lost, or something seems wrong, report it even on holiday. For loss, a password typed into a suspicious page, or a suspicious file opened, have people call the designated contact without hesitation. Have them disconnect from the network (turn off Wi-Fi or unplug the cable) but not power off, so information needed for investigation is preserved. For suspected ransomware see First response to ransomware, and for the general first steps in emergencies see First-response guide for IT emergencies.

The first hour determines how much damage from the break can be contained. As a rule, do these four steps before opening email.

1. Restart equipment and apply updates. Check for fixes released during the break and apply what is needed, as IPA also asks. Also confirm that anything you powered off, such as routers, UTMs, and NAS, works correctly after power-on. Until updates finish, do not browse external sites or open mail.

2. Update antivirus definition files. PCs that were powered off keep old definitions. Update before sending or receiving mail or browsing. Scan PCs and USB drives that were taken out before connecting them to the internal network.

3. Triage the accumulated mail before opening it. Check subject lines and senders, and consult the administrator before opening any of the following.

- Messages from unknown partners or unusual sender addresses
- Urgent wording such as "immediately", "by today", or "your account will be suspended"
- Attachments such as invoices, delivery slips, or password-protected ZIP files
- Requests to change a bank account at an unusual time

If you receive a suspicious email, do not open attachments or URLs; report it to the administrator and follow instructions.

4. Check logs and device status. Look for suspicious access during the holiday in server, VPN, and router logs, as IPA also asks, and investigate quickly if anything looks wrong. Reading logs is hard for small firms, so narrow the focus.

- Successful logins at night or early morning, for example from overseas
- Password changes or new accounts for administrators
- Large numbers of files rewritten in a short time on NAS or servers (a ransomware sign)
- Unintended restarts or configuration changes on devices
- Unfamiliar locations or devices in the sign-in history of cloud services such as Microsoft 365 or Google Workspace

Without IT staff, tasks slip because everyone assumes someone else is handling them. Assign a name per phase as in the table. In a small company, one person can cover several roles.

You can outsource what you cannot do in-house. The amounts below are general rough guides only; actual fees vary greatly by number of devices, sites, contract terms, and vendor. Compare several quotes and the scope of work.

When getting quotes, always confirm whether the contact desk operates during the holiday, where responsibility for update work ends, and whether a report follows. If you already have a maintenance contract, first check whether a pre-holiday check is included.

- IPA, Information security measures during long holidays: https://www.ipa.go.jp/security/anshin/measures/vacation.html
- IPA, Year-end alert for fiscal 2025 (published December 16, 2025): https://www.ipa.go.jp/security/anshin/heads-up/alert20251216.html