As another year wraps up, many Australian small business owners are looking forward to a well-deserved break. Whether you’re planning a family holiday, taking a few days off, or simply closing the office during the quiet period, stepping away from your business for some rest and relaxation is an important part of maintaining work-life balance.
Before you lock the door and switch on your out-of-office reply, the Australian Taxation Office reminds business owners to take some simple security precautions. These straightforward steps help protect your business and your clients’ information while you enjoy your time off. Taking a little time now for preparation can prevent significant problems later and give you genuine peace of mind during your break.
Six Simple Security Steps Before You Close
The ATO recommends six straightforward security measures that every business should implement before closing for holidays. These don’t require technical expertise or expensive security systems. Most can be completed in under an hour, and they significantly reduce your security risks during closure periods.
Let’s walk through each of these practical steps and understand why they matter for your business.
Step 1: Lock Up or Securely Dispose of Physical Files
Many small businesses still work with physical documents including client files, invoices, contracts, financial records, and sensitive correspondence. These documents contain valuable information that needs protection during your closure period.
Before closing for holidays, take these actions:
- Gather all sensitive documents: Collect physical files containing business or client information from desks and open areas.
- Store securely: Place documents in locked filing cabinets or secure storage areas. If your office doesn’t have lockable storage, consider taking critical documents to a secure location.
- Review and dispose properly: Identify documents you no longer need and shred them rather than discarding in regular bins. This includes outdated client records, financial statements past their retention period, and any paperwork containing confidential details.
Proper document disposal protects both your business and your clients’ privacy.
Step 2: Keep Laptops, Tablets, and Phones Out of Sight and Secure
Business devices such as laptops, tablets, and mobile phones contain valuable information and represent significant investment. They also provide access to your business systems, email, banking, and client data.
Before leaving for your break, protect your devices:
- Remove from plain sight: Don’t leave laptops sitting on desks, tablets on counters, or phones in open areas.
- Store securely: Lock devices in cabinets, safes, or secure rooms where they’re not visible or easily accessible.
- Consider taking critical devices home: If possible, take devices containing the most sensitive business information or providing access to financial systems home with you. This removes the risk entirely during your closure period.
Step 3: Sign Out of All Accounts and Devices
One of the simplest yet most important security measures is signing out of all accounts and devices before your holiday break. Leaving sessions open makes them vulnerable to unauthorised access if someone gains access to your devices or office.
Before closing, complete these sign-out steps:
- Log out of all business accounts: Sign out of banking portals, accounting software, email accounts, cloud storage, business management systems, and any other platforms you use.
- Use proper logout functions: Don’t just close browser tabs or applications; actually sign out using the logout function.
- Shut down computers completely: Power down computers rather than leaving them in sleep or standby mode. This ensures all active sessions close properly and provides an additional layer of security during your absence.
Step 4: Update Your Software
Outdated software systems are easy targets for security threats. Software developers regularly release updates that fix security vulnerabilities and improve protection against emerging threats.
Before your holiday break, handle software updates:
- Install all available updates: Check for and install updates for your computer’s operating system, web browsers, antivirus programs, accounting software, and any other business applications you use regularly.
- Enable automatic updates: Turn on automatic updates wherever possible. This setting ensures that critical security patches install automatically, even during your absence.
- Take the guesswork out: Automatic updates help maintain ongoing protection without requiring your constant attention. The ATO specifically recommends this as a key security measure.
Step 5: Back Up Files and Devices Regularly
Regular backups protect your business data if devices are damaged, lost, stolen, or infected by malware. Backing up before your holiday closure is particularly important because you won’t be monitoring systems during your absence.
Before leaving for your break, implement these backup practices:
- Back up all critical data: Include financial records, client information, business documents, important emails, and system configurations in your backup.
- Use physical backup devices: Store copies on external hard drives or USB storage devices that you keep separate from your main computer systems.
- Use cloud backup services: Store your data securely online, providing protection even if something happens to your physical office or equipment.
- Make it a regular habit: Establish a consistent backup routine throughout the year, not just before holidays. The ATO recommends backing up regularly to ensure your data remains protected.
Step 6: Remove User Permissions for Employees Who Have Left
Unauthorised access to systems by past employees is a common cause of identity security or fraud issues for businesses. Former employees who retain login credentials to your business systems represent an ongoing security risk.
Before your holiday break, manage user access properly:
- Review all user accounts: Audit system access permissions across all business platforms and applications.
- Remove access for departed employees: Delete or disable accounts for employees who have left your business or who don’t require system use.
- Cover all systems: Include accounting software, email accounts, cloud storage, business applications, and any other platforms containing business or client information.
- Prevent unnoticed access: This step is particularly important before holiday closures because unauthorised access might go undetected while you’re away.
Taking time now to audit and remove unnecessary access helps protect your business and maintains the security of client information.
Putting These Steps Into Practice
These six security measures don’t require technical expertise or significant time investment. Most businesses can complete all steps in less than an hour before closing for holidays. The small amount of time invested now can prevent costly disruptions and protect both your business and your clients’ trust.
Consider creating a pre-holiday security checklist that includes each of these steps. Keep this checklist with your other end-of-year business procedures so you remember to complete these tasks before every closure period. As you complete these steps each year, they become faster and more automatic.
The ATO emphasises that taking these steps now helps you avoid costly disruptions later and keeps your clients’ trust intact. Simple preparation creates peace of mind, allowing you to genuinely relax and enjoy your well-earned break knowing your business is protected.
Additional Cyber Security Resources
The ATO provides comprehensive guidance on cyber security for businesses beyond holiday preparation. Their Top Cyber Security Tips for Businesses covers broader security practices you can implement throughout the year to maintain ongoing protection.
For businesses wanting to learn more about protecting themselves from identity security issues and scams, the ATO’s Identity Security and Scams resources provide valuable information and current alerts about threats targeting Australian businesses.
Regular engagement with these resources helps you stay informed about emerging security threats and best practices for protecting your business and client information throughout the year.
Stay Cyber-Safe This Holiday Season
As you prepare to close your business for a well-deserved break, remember that a little preparation goes a long way. These six simple steps from the ATO help protect your business and your clients’ information while you’re away: lock up or securely dispose of physical files, keep devices out of sight and secure, sign out of all accounts, update your software, back up files regularly, and remove user permissions for employees who have left.
Taking these precautions now helps you avoid costly disruptions later and keeps your clients’ trust intact. More importantly, it gives you genuine peace of mind to relax and enjoy your holiday knowing your business is protected.
The Cotchy team wishes you a safe and relaxing holiday period. We’ll continue monitoring your bookkeeping and financial reporting as usual, and we’ll be here when you return to help with any year-end requirements.
FAQ
Q: What security steps should I take before closing my business for holidays?
A: The ATO recommends six key steps: lock up or securely dispose of physical files, keep laptops, tablets and phones out of sight and secure, sign out of all accounts and devices, update your software and enable automatic updates, back up files regularly on physical devices or cloud, and remove user permissions for employees who have left.
Q: Why is it important to sign out of business accounts before holidays?
A: Leaving sessions open makes them vulnerable to unauthorised access. If someone accesses your devices or office, they can use your active sessions without needing passwords. Sign out of banking, accounting software, email, cloud storage, and all business platforms before closing.
Q: Should I use physical or cloud backups for my business data?
A: The ATO recommends using both physical backup devices (like external hard drives) and cloud-based backup services. This provides maximum protection – if something happens to your physical office or equipment, your cloud backups remain safe and accessible.
Q: Why should I remove system access for former employees before holidays?
A: Unauthorised access to systems by past employees is a common cause of identity security or fraud issues for businesses. Former employees who still have login credentials represent an ongoing security risk, particularly during holiday closures when unauthorised access might go unnoticed while you’re away.
Source
ATO:
Holiday Cyber Security (Original Article): https://www.ato.gov.au/businesses-and-organisations/small-business-newsroom/secure-your-workplace-to-stay-cyber-safe-over-the-holidays
Top Cyber Security Tips for Businesses: https://www.ato.gov.au/online-services/cyber-safety/top-cyber-security-tips-for-individuals
Identity Security and Scams: https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection
