People ask me which suite to buy. A name from a trade fair, a security operations centre, a shiny dashboard. For a fifteen-person firm, I start somewhere else. Three concrete moves this week — ones you can actually finish.
The backup nobody has ever restored. The NAS password still set to whatever was chosen at install, pasted into a Teams channel. Windows, Odoo or the NAS that have not taken a patch in far too long.
I already wrote about invoicing from Excel and automating invoice reminders. This piece is a different subject. No attack percentages: I do not have one I can stand behind. For the broader security and method frame at z80, see also Watch Your Hack.
Belgium’s Centre for Cybersecurity publishes a booklet, CyberFundamentals, Small level. Multi-factor authentication, install updates at once, an offline backup, test the restore, no admin rights for everyday work.
The backup nobody restored
The scheduled task runs at night. The light is green. Nobody has ever pulled a file out.
The CCB’s Small booklet: automated backups, an offline copy every week or every couple of weeks, and restore tests at regular intervals. They say it for a major incident, ransomware included. A copy sitting on the same NAS as the working folders is not a separate copy. If the box is encrypted or wiped, that copy goes with it.
This week, pick one file that matters. A quote, a workbook, a supplier bill. Restore it somewhere else, another folder, and open it. If that fails, write it down, fix the task. Once. Not a project.
Odoo Online: the docs and the cloud service agreement talk about a daily backup. You can download a ZIP from the database manager. This week, take one, put it somewhere other than the owner’s laptop. On a local install, that is on you: database and file storage, on another machine, before you touch an update.
In January 2026 the CCB wrote about immutable backups: a copy that cannot be changed or deleted. For a twenty-person firm the first move is still a disk you unplug.
GDPR Article 32 asks for appropriate technical and organisational measures, scaled to the risk. Restore the data in an appropriate time, and test that it holds. I am not a data protection officer. The Belgian Data Protection Authority, in its SME handbook, already lists systematic backups and automatic updates among measures any small firm can put in place.
Shared accounts, leftover admins
“The NAS password is admin plus the company name.” You still hear it. Or one Microsoft 365 account used by five people, sitting in Teams.
The CCB again, Small: do not share passwords with colleagues. A user account for the day, a separate admin account, multi-factor authentication on the admins. The Authority: one unique login per person.
This week, open the list.
Microsoft 365: active users. Who still belongs. Who holds Global Administrator. A former salesperson who still has a mailbox — it happens. Disable the account, drop the role. The owner does not need to be an admin all day to read mail.
Google Workspace: Admin console, users. Same job. Google already requires 2-Step Verification on administrator accounts. Everyone else, often not.
Odoo: Settings, users. The shared install login, used by three people: turn it off. One account each, job rights, nothing extra.
If you already run Microsoft 365 or Google Workspace, turn on two-factor authentication. The CCB: multi-factor wherever you can, always for remote access, VPN or remote desktop included.
At Microsoft, security defaults exist on Entra ID Free. Entra admin centre, Identity, Overview, Properties, Manage security defaults. Switch them on. Tenants created after October 2019 often have them already. If someone switched them off because they were annoying, switch them back. Conditional Access is a different licence. I am not selling that.
At Google: Admin console, Security, Authentication, 2-step verification. Allow it first, tell the team, then enforce. Not a Monday morning with no mail.
Windows, Odoo, the NAS
The CCB: apply security patches as soon as they are out. On PCs, automatic updates as the default. One day a month for the rest, if it is not automatic.
Windows: Settings, Windows Update. Check that it actually installs. Walk the floor, three machines at random. Defender is already there; confirm nobody switched it off.
Odoo Online: Odoo applies the fixes; cloud updates are automatic. On a local install, that is you: download today’s package, install over the current one, restart. Backup first. If an integrator put the machine in, it is still theirs.
The NAS. Synology, QNAP, whatever is in the cupboard. Open the panel, firmware, install. Change the factory admin password. Stop putting the admin interface on the open internet. A VPN, or leave it closed. The Small booklet is blunt about remote access.
What you actually do this week
One file restored, somewhere else, opened.
The Microsoft 365, Google Workspace or Odoo user list. People who left, cut. No admin rights for the working day.
Security defaults, or Google 2-step verification, on. A mail to the team first.
Windows Update on the PCs. NAS firmware.
An offline copy: a disk, unplugged, in a drawer.
If the restore failed, or the admin list is a mess, info@z80.be, +32 494 111 041, www.z80.be — an hour pack, we walk through it, not a suite.