Seven Jobs Before the Office Empties: A Winter 2026 Security Checklist for UK Small Firms
Photo: President (1981-1989 : Reagan). White House Photographic Office. 1981-1989, Public domain, via Wikimedia Commons
There is a particular kind of quiet in a UK office on 27 December. The heating is on low, the tinsel is drooping, and one person is 'keeping an eye on things' while everybody else eats leftovers. It is also, from a criminal's point of view, the most attractive fortnight of the year.
Seasonal scams pile into inboxes from late November, and ransomware crews know that a skeleton crew plus a slow response equals a bigger payout. Add a Finance team distracted by Christmas parties and a run of parcel-delivery emails everyone is genuinely expecting, and you have the perfect conditions for a very expensive January.
None of the following takes more than an afternoon. Do them before the office empties.
1. Prove your backups actually restore
A backup report that says 'completed' is a rumour. A restore is evidence. Pick a folder, a mailbox and a line-of-business system, and restore them to a test location while someone watches. Check that you have at least one copy that is offline or immutable — ransomware's favourite trick is to hunt down and encrypt the backups first.
Quick win: book a 30-minute restore test this week and write down how long it took.
Brief the team: tell them where the backup documentation lives and who to call if they see a ransom note.
2. Enforce MFA everywhere, then check again
Multi-factor authentication is the single best-value control most small firms have, and it is also the one most likely to have a gap. Remote access, Microsoft 365, your finance package, the payroll portal, the shared password manager — all of it. Then go looking for the exceptions somebody created in a hurry in February.
Quick win: run a report on accounts without MFA and fix them today. Switch off legacy email protocols still allowing basic authentication.
Brief the team: if a login prompt arrives when they are not logging in, that is a real attack. Report it, do not approve it.
3. Patch the boring kit nobody thinks about
Everyone remembers Windows updates. Far fewer remember the firewall firmware, the VPN appliance, the remote-management agent, the NAS in the corner and the label printer with a web console. Remote-access tools in particular are catnip to attackers because one flaw hands over the whole network.
Quick win: pull a list of everything with an IP address and confirm each one's firmware date.
Brief the team: if anyone is still using a personal device or an old remote-desktop shortcut from home, flag it before the break.
4. Sweep out the ghost accounts
Holiday cover means temporary access, and temporary access has a habit of becoming permanent. Look for accounts belonging to leavers, contractors, shared 'admin' logins and the intern from the summer. Reduce administrator rights to the handful of people who genuinely need them.
Quick win: export your user list, compare it to payroll, and disable anything unexplained.
Brief the team: anyone covering for a colleague gets their own account, not a shared password.
5. Rehearse the seasonal scams
November and December bring a predictable cast: fake HMRC refund emails and texts, courier 'we missed you' messages with a small redelivery fee, bogus invoices from a supplier with new bank details, and payroll emails about a 'Christmas bonus' that nobody in HR sent.
Quick win: send a test phishing email this month and use the results as a five-minute talking point, not a telling-off.
Brief the team: any request to change bank details gets verified by phone on a number you already hold. Slowness is a virtue in December.
6. Agree who is on call, and what they can do
A skeleton crew with no authority is worse than no crew at all. Decide in advance who can approve an emergency spend, who can isolate a device from the network, and how quickly your IT provider will respond on 29 December. Put the escalation numbers somewhere that is not only in one person's inbox.
Quick win: write a one-page holiday plan with names, numbers and the first three things to do if something looks wrong.
Brief the team: set proper out-of-office replies, and remind everyone not to post travel plans on social media.
7. Prepare for the worst so you are not improvising
If ransomware lands during the break, panic costs hours. Have a printed incident card: who to call, how to isolate the affected machines, which insurer and legal contacts to notify, and the 72-hour clock for reporting a personal data breach to the Information Commissioner's Office where it applies. Keep it offline. Your incident plan should not live only on the server that just got encrypted.
Quick win: print the card and stick it in the comms cupboard next to the fire drill.
Brief the team: if a machine starts behaving strangely, unplug the network cable and ring in. Do not try to fix it quietly.
One last thing before you switch off the lights
Book a short review for the first week of January while everyone still remembers what went wrong last year. That is also the ideal moment to sort out Cyber Essentials, answer your insurer's security questionnaire, and set a patching routine you will actually keep. Winter is quiet. Use the quiet.
