Write the handoff for the moment something breaks over the holidays and the person covering has only this page. Build it one problem at a time, then test it with that person before you leave.

In a joint advisory first published in 2021, Ransomware Awareness for Holidays and Weekends (cisa.gov/…), the FBI and CISA reported an increase in highly impactful ransomware attacks on holidays and weekends, when offices are normally closed and IT support is at limited capacity. They recommended identifying IT security staff to be available and on call during those periods. In a small office, that is often the person covering.

Choose the problems and what each entry holds

Start with the failures that would stop work or reach customers before you return, which for many small organizations means the website, email and sign-in. Give a problem its own entry if staff or customers would notice it during the break, if someone would need to decide something before you are back, or if the backup can take a useful first step. Put everything that can wait on one line at the end, so the backup knows waiting is the answer.

Each entry answers the same five questions, in the same order:

  • How to confirm the problem, and whether it affects everyone or one person or device.
  • Who inside the organization can approve emergency work, spending or a notice to customers.
  • Which support channel to use, the account name it will ask for and the people it will talk to.
  • What to put in the ticket.
  • What the backup must never do, such as reading a sign-in code to a caller.

Start with a website outage

A website outage uses every part. The status check is the web host's public status page, if it has one, plus a check from a phone with Wi-Fi turned off. If the site loads over mobile data but not in the office, suspect the office connection, and name whoever deals with the internet provider.

Then write down the internal contact who can approve emergency work or a notice to customers, the host's support channel, the account name and the people the host will talk to. Before you leave, confirm in the host's account settings that the backup is on that list.

For the ticket, Google's list of what to gather before contacting support works for any provider:

  • What happened, and what should happen if things were working.
  • The steps that reproduce it, with the date, time and time zone it occurred, and anything already tried.
  • Whether it happens every time or only sometimes, and whether it also happens on another device, browser or network.
  • A legible screenshot showing the full web address and the exact error.
  • The affected usernames, plus the browser, operating system, extensions and security software in use.

Google says exact error messages speed up its review of system logs, so the backup should copy the wording rather than describe it. Google also says not to send sensitive data such as passwords, government identification numbers or cardholder data to support, and warns that an HTTP Archive (HAR) file includes the content of pages loaded while recording, sensitive content included. Put those rules in the handoff as well.

Check email status in Microsoft 365

In Microsoft 365, the status check is the Service health page in the Microsoft 365 admin center, under Health in the left-hand navigation. Microsoft suggests checking it to see whether a problem is a known issue with a resolution in progress before you call support or spend time troubleshooting. If you cannot sign in to the admin center, Microsoft points to its service status page and its @MSFT365Status account on X.

An advisory means some users are affected but the service is still available, often with a workaround. An incident means the service or a major function is unavailable, for example when users cannot send and receive email or cannot sign in.

Each issue also shows a status, and these are the ones to explain to the backup:

  • Investigating, which means Microsoft is gathering information about a potential issue.
  • Service degradation, a confirmed issue such as slowness, intermittent interruptions or a broken feature.
  • Service interruption, which means users cannot reach the service and the problem reproduces consistently.
  • Restoring service or Extended recovery, which mean a fix is under way, the second taking time to reach every affected system.
  • Investigation suspended, which means Microsoft needs more information from customers and will say what it needs.
  • Service restored, which means Microsoft has confirmed the fix.

Selecting an issue shows its ID, affected services, user impact and every update, which is what staff will want to hear. If the issue is listed, the backup follows those updates. If it is not, Report an issue on the same page opens a short form, and the Reported issues tab shows what your organization has reported and its status.

Planned maintenance does not appear in Service health; Microsoft tracks it in the Message center, in messages categorized as Plan for change. Under Customize, then Email, each admin can select Send me email notifications about service health and choose up to two addresses, incidents or advisories, and the services to watch. The Microsoft 365 Admin app shows Service health on a phone, with push notifications.

Check email status in Google Workspace

Google publishes the Google Workspace Status Dashboard for core services such as Gmail, Google Calendar and Google Meet. Selecting a notification gives more detail, including an estimate of when the issue might be resolved, and Google posts a final update when it is. Google says to contact Google Workspace support to report an issue with a service.

For alerts, Google recommends the dashboard's RSS feed, which it says gives the fastest outage alerts. A system-defined rule on the Rules page of the Google Admin console can also send Apps outage alerts, but Google cautions that these might arrive more slowly than the RSS feed, and that email alerts may be delayed if Gmail is affected.

Plan for sign-in problems and reset requests

For sign-in problems, add who can reset passwords and how they confirm a request is real, such as calling back on the number in your staff list. CISA's Scattered Spider advisory, last revised in July 2025, describes attackers posing as employees to get help desk staff to reset passwords and move multifactor authentication to devices they control. It also describes repeated sign-in prompts sent until someone accepts, and calls made first to learn what steps a help desk takes to reset a password.

An urgent reset request while the usual contact is away deserves the same callback. Write the rule plainly: no password reset and no change to anyone's sign-in methods until the backup has called the person back on the number already on file, and no codes read to anyone who calls.

Plan for a locked-out administrator, too. Microsoft says another Global Administrator or a Privileged Authentication Administrator can reset a Global Administrator's password, so write down who would do that. Google recommends more than one super administrator account, each managed by a separate individual, and says admins should add a recovery phone number and email address, print backup codes and enroll a spare security key.

Check who each support line accepts

Microsoft's business support requires an admin, and if you bought every subscription through a partner, Microsoft says to contact the partner. A caller on a number not registered with your organization must give a verification code that Microsoft sends to the registered email or phone, so the backup should call from a registered number or be able to read that code. Microsoft provides technical support in English 24 hours a day, 7 days a week, but in most countries billing support runs 9 AM to 5 PM, Monday through Friday.

To start a request, an admin selects Help & support at the bottom right of the admin center, describes the problem and, if the suggested answers don't help, selects Contact Support, chooses phone or email and selects Contact me. Microsoft notes that its support phone numbers have changed, so link to its current global phone numbers list instead of copying a number.

Contacting Google Workspace support requires the Support administrator privilege. Requests start from Get help at the top right of the Google Admin console, where an admin describes the issue, enters Contact support and chooses chat or email. Google says to expect an initial response within one business day or less, and its P1 priority covers a critical service-access issue affecting more than one user with no workaround, such as widespread email delays. Whatever the provider, the ticket should say how many people are affected and whether there is a workaround.

Give the backup limited roles of their own

Check that the backup can open each resource with their own access, not yours. Both vendors favor limited roles: Google recommends a least privilege approach, and Microsoft recommends roles with the fewest permissions. To let someone reset passwords, Microsoft says to assign Password Administrator or Helpdesk Administrator rather than Global Administrator.

Microsoft's Helpdesk Administrator role can reset passwords, force users to sign out, manage service requests and monitor service health. It can only help users who aren't administrators, plus users in a few limited roles. Service Support Administrator can be added alongside another role for someone who needs to open service requests and monitor service health. To assign either, open Role assignments in the admin center, select the role and add the person on its Assigned admins tab.

Microsoft recommends requiring multifactor authentication for administrators, and Google recommends 2-Step Verification for admin accounts, with security keys as the most secure form. Microsoft notes that once multifactor authentication is on, the next sign-in asks for an alternate email address and phone number for account recovery, so make the rehearsal that sign-in, on the backup's own phone.

Keep secrets out of the handoff

Keep recovery secrets in the vault and link to the instructions. Store a copy of the handoff where the backup can reach it if email or sign-in is what broke, such as on paper or saved on their phone. Assume it may be printed or forwarded, so it should hold links the backup opened in the rehearsal, never passwords or codes. Before you share it, search it for words like password, PIN and code.

Rehearse with the backup before you leave

Have the backup walk through one scenario while the primary is still available. Describe the problem and let them answer from the handoff alone: what they check first, who they contact and what the ticket says. Fix every step where they stall, then run a second scenario on a different system.

The handoff is ready when the backup, using only their own accounts and devices, can:

  • Sign in to each admin center and complete multifactor authentication without your phone.
  • Open Service health or the Status Dashboard and explain what the current status means.
  • Reach the support request screen without a permission message.
  • Find their own name on the web host's contact list.
  • Open every link in the handoff, including each vault entry they need.
  • Reach a copy of the handoff without signing in to email, and explain the callback rule in their own words.

Common mistakes and how to spot them

Most gaps show up only when someone other than the author uses the page. Look for these:

  • The only administrator is the person leaving. Open Global Administrator under Role assignments and count the names on its Assigned admins tab, or count your super admins in Google.
  • Support was bought through a partner, but the handoff lists Microsoft. Check your invoices and list the partner if every subscription came through one.
  • The backup can't receive Microsoft's verification code. Confirm which registered phone or email it would go to.
  • Alerts still go only to the absent person. Microsoft's notification settings are per admin, so add the backup's address, or subscribe the backup to Google's RSS feed.

A worked example

Imagine an eight-person property management office whose office manager is away for the holidays while the bookkeeper covers. In the rehearsal, the bookkeeper cannot open the Microsoft 365 admin center, the web host does not list her as a contact, one vault link opens an empty folder, and Service health emails go only to the office manager.

Before leaving, the office manager assigns her the Helpdesk Administrator role, adds her as a host contact, fixes the link, adds her address to the Service health notifications and prints the handoff. On a second run, the bookkeeper signs in with her own account, opens Service health and finds the host's support channel using only the handoff.

Later in the break, staff report that Outlook will not send. The bookkeeper finds an Exchange Online incident marked Restoring service, follows the updates instead of opening a ticket and tells staff what she found. When a caller who says he is a property manager asks her to reset his password and move his sign-in to a new phone, she calls back on the number in the staff list, learns he made no such request and reports the call to the contact named in the entry.

What to do this week

Start now, so the rehearsal happens while you are still in the office:

  • Name the backup and the dates they cover, and pick the three problems that would hurt most.
  • Write one entry for each, using the five parts above.
  • Assign the backup a limited admin role and have them set up multifactor authentication on their own phone.
  • Add the backup to each vendor's contact list and to the status alerts.
  • Confirm a second Global Administrator or Privileged Authentication Administrator, or a second super admin.
  • Review the backup schedule for anything that could interrupt backups over the break, as the FBI and CISA advise, and decide who will see a failure.
  • Settle billing questions on a weekday, run the rehearsal, fix what stalls and store an offline copy.

Short answers to common questions

The handoff can be short. If an entry runs past a page, the fix probably belongs with the vendor or your IT provider, not the backup.

The backup does not need Global Administrator. Microsoft says Global Administrators have almost unlimited access to your organization's settings and most of its data, and recommends having as few as possible.

An IT provider goes in the handoff like any other support channel. Record how the backup reaches it, and confirm before you leave that the provider will take requests from them.

Suspected ransomware needs its own entry. In the Scattered Spider advisory, the FBI and CISA urge organizations to report ransomware incidents promptly to the FBI's Internet Crime Complaint Center, a local FBI field office or CISA, and say they do not encourage paying a ransom.

Phishing-resistant sign-in is the longer-term fix. The same advisory recommends FIDO/WebAuthn or PKI-based multifactor authentication, which it says resists phishing and is not susceptible to push bombing, the repeated prompts described above, or to SIM swaps, in which a carrier is persuaded to move someone's phone number to an attacker's SIM card.

Where ALCO can help

ALCO USA Inc's listed services include help desk, Microsoft 365, Google Workspace, managed hosting and website care. If ALCO supports your systems, list its help desk in the handoff like any other support channel: it is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources