ARMI - KN

Identity and Access Management (IAM) Lifecycle: How User Provisioning and Deprovisioning Functions in NetSuite

In NetSuite, user provisioning and deprovisioning is managed through the Employee Record, which serves as the central control point for creating accounts, assigning roles or global permissions, and managing access throughout the user’s lifecycle. When a new user is onboarded, their account is created and roles are assigned directly within the Employee Record, while the Manage Roles page is used to customize role definitions / design. Administrators can also grant Global Permissions directly via the Employee Record—a capability that requires careful oversight, as it can bypass role-based controls and introduce privilege creep if not closely monitored.

Why Single Sign-On Security Matters

When it comes to securing your NetSuite environment, centralizing authentication is one of the most effective control decisions you can make. Single Sign-On (SSO) security not only streamlines the login process for end users but also allows administrators to enforce consistent password, MFA, and session controls across all systems, ensuring consistent authentication controls are applied. From a compliance standpoint, this centralization pays off—whether you’re preparing SOX evidence, aligning with GDPR, or simplifying audit testing, SSO reduces the number of moving parts and the likelihood of gaps.

Phishing and Credential Theft: The Fastest Path to ERP Breach

NetSuite MFA: Recap of Part 1

In Part 1, we broke down how MFA works in NetSuite, where it’s configured, and the supported methods. Now, let’s tackle the bigger question—why MFA should be universally applied to all roles, the problem with exceptions, and what controls keep you compliant and secure.

Why A Strong Password Policy Matters

Think of your NetSuite environment like your company’s HQ. If the front door is flimsy, it doesn’t matter how many security cameras or motion sensors you have—someone’s going to stroll in and help themselves to your sensitive data, financial data, or, if the account happens to be privileged, potentially grant themselves keys to the kingdom and wreck mayhem in any way they see fit. That’s why password security isn’t just a “nice to have,” it’s a must-have, especially if you’re subject to SOX compliance. The NIST SP 800-63B guidelines, basically the “how to do passwords right” manual, state the following:

Inactive User Accounts: Security and Compliance Context

Managing dormant and inactive user accounts is a critical component of ERP security and compliance. Frameworks like NIST SP 800-53 and ISO 27001 require periodic reviews of user credentials, and SOX demands timely access revocation for systems impacting financial reporting. The rationale is simple—an unused account is still a potential entry point for an attacker, and the longer it sits unnoticed, the higher the risk it will be exploited.

Why Configuration Pages Matter and Must Be Controlled

NetSuite Setup Pages That Require Change Control

In NetSuite, certain configuration pages form the foundation of how the system operates and play a critical role in supporting organizational controls. These settings not only drive system logic but also determine the effectiveness of monitoring and audit capabilities. For example, if the Log System Notes on Update Only option within General Preferences is enabled, the system would capture audit logs only for record updates, not record creations—creating a significant blind spot for monitoring and audit reliability. Because changes to these pages can directly affect financial reporting, compliance posture, and overall system integrity, organizations must classify them as high-risk and subject them to formal Change Control. This ensures that every modification is properly reviewed, approved, and documented to maintain both operational stability and audit readiness.

NetSuite Sandbox Refresh: What It Actually Does

A NetSuite sandbox refresh is like hitting the clone button on your Production account. With one request, your Sandbox is replaced with a snapshot of Production, including configurations, data, customizations, and even user passwords. It’s the cleanest way to keep your test environment aligned with the real thing — but it comes with a few rules you don’t want to ignore.

NetSuite Change Control: The False Sense of Security

When it comes to auditing NetSuite, many organizations assume their change control processes are solid. The tickets are created, the approvals are documented, and the audit logs are in place. Yet controls often fail not because change management is absent, but because organizations have not built a complete inventory of setup and configuration pages that must be subject to change control. Without this inventory, users and roles frequently end up with unauthorized access to sensitive settings. Any page deemed as one that needs to be subject to the change management process should be restricted to IT administrators or senior business process owners — not left open to general business users. These are the quiet, foundational screens like Accounting Preferences, Fiscal Calendars, Accounting Periods, and General Preferences that directly influence financial reporting, security posture, and compliance standing. Overlooking them is where real audit gaps appear.