The gap between deciding and telling IT
Most businesses settle their shutdown dates around now. IT usually finds out in the third week of December, which is also the week half the office wants a laptop set up so they can check email from the coast.
An empty office is not an idle one. The systems keep running, the subscriptions keep renewing, and the people who would normally notice something odd are away. Most of what lands on the help desk in January was already there in December, sitting quietly in a comms room nobody walked past for four weeks.
Here is the checklist we work through with clients, in the order it usually needs to happen.
Four weeks out
- Write down who is actually contactable. Not a department, names and mobile numbers, with a second name for when the first one doesn't answer. Send that list to your IT provider as well as your own staff.
- Check what your agreement says about after-hours and public holidays. Support outside business hours is either built into your fee or charged at an agreed rate, and the time to find out which is now, not at nine o'clock on the 28th. Ask for the answer in writing.
- Find out what expires while you're closed. Domain names, SSL certificates, software subscriptions, and the credit card they all bill to. A card that expires on 31 December will take something down with it, and the renewal warning will land in a mailbox nobody is reading.
- Flag anything that needs a person in the building. A failed drive or a dead switch needs hands on site. Agree now who can get in, who holds the alarm code, and whether the building is even accessible between Christmas and New Year.
- Pick a change freeze date. Usually about a week before you close. After that, nothing new gets deployed, no migrations, no firmware, no "quick" changes. If something breaks on the 19th you still have people around to fix it.
Two weeks out
- Patch and reboot now. Servers, network gear, workstations. Updates that install themselves on the 23rd and want a restart will sit there until someone comes back, and a machine waiting on a reboot is a machine running half-applied patches.
- Test a restore, don't just check the backup ran. A green tick means the job finished. It doesn't mean the data comes back. Pick a real file and a real mailbox, restore them somewhere safe, and open them. Backup is a security control as much as an IT one, and the quiet weeks are exactly when you would need it.
- Clear the alerts you have been living with. Every network has a couple of warnings everyone has learned to scroll past. They are much harder to spot as new when you come back to four weeks of them.
- Sort out phones and out-of-office. Where the main line goes, who picks up the mobile, what the voicemail says, and when the auto-replies switch on and off. Put the return date in the message rather than "over the break", which ages badly.
- Check the finance calendar. Payroll runs, superannuation, BAS and invoicing that fall inside the shutdown still need someone with access to the system and the bank. Confirm that person is contactable and that their MFA works on the phone they are taking with them.
The last week
- Stop deploying. The freeze you agreed four weeks ago only works if someone enforces it on the day.
- Decide what gets powered down and what must not. Desktop machines and monitors can go off. Comms racks, firewalls, anything the alarm or the phones depend on, and anything a cloud service connects back to should stay on. Write the list down and tape it to the rack, because the person who turns the lights off is not usually the person who knows.
- Deal with laptops going home. Confirm they are encrypted and that the staff member knows not to leave one in a car. A laptop stolen from a back seat in January is the most ordinary breach there is.
- Get the escalation list off the wall and into people's phones. Include the after-hours number for your IT provider, and make sure more than one person has it.
What not to switch off
Two things catch people out every year.
The first is powering down a machine for the whole break. It comes back four weeks behind on patches, and for the first few hours of the first morning it is the least protected device on your network, being used by someone who is still looking for their password. Leaving it on and patching it beforehand is safer than a cold start in January.
The second is the quiet dependency. An on-premises server that syncs to a cloud service, a certificate that renews automatically but only if the machine is reachable, a licence check that runs monthly. None of these announce themselves. If you genuinely have to turn something off, ask what else talks to it first.
While you're closed
Monitoring does not take leave. If you have a managed service, alerts keep arriving and someone keeps watching them. What needs settling before you close is which of those alerts earns a phone call, and which one waits until you are back.
Agree the threshold in advance. Something that stops the business, a security alert or a failed backup usually means a call to whoever is on your contact list. A printer that has gone offline does not. Having that conversation in December means nobody is making a judgement call about your business on New Year's Eve without knowing what you would have wanted.
The first morning back
Expect a queue on the first morning, and plan for it.
- Passwords expire over a four week break. So do some MFA registrations. Both generate help desk calls within the first hour, from people who cannot sign in to ask for help.
- Everything patches at once. Machines coming out of hibernation all pull updates on the same morning, which is slow for everyone.
- Check what failed silently. Scheduled tasks, backup jobs, integrations and anything that depended on a certificate. The alert may have fired into an empty inbox three weeks ago.
- Stagger the return where you can. If IT and finance come back a day before everyone else, the first morning is a much calmer one.
The bottom line
Patch before you leave, prove the backup restores, and agree who answers the phone.
Most of the work is deciding things in November that you would otherwise decide badly in a hurry on the 23rd of December: who is contactable, what your agreement actually covers out of hours, what stays switched on, and what counts as urgent enough to ring someone about. The list only has to be written once. After that it is a fifteen minute review each November.
If you'd like us to run the pre-shutdown checks on your environment, or you want the after-hours arrangement clear in writing before you close, our help desk team can sort it out, or you can get in touch.