Managing Dormant and Inactive User Accounts

Inactive User Accounts: Security and Compliance Context

Managing dormant and inactive user accounts is a critical component of ERP security and compliance. Frameworks like NIST SP 800-53 and ISO 27001 require periodic reviews of user credentials, and SOX demands timely access revocation for systems impacting financial reporting. The rationale is simple—an unused account is still a potential entry point for an attacker, and the longer it sits unnoticed, the higher the risk it will be exploited.

• NIST SP 800-53 IA-4 / AC-2: Requires periodic review and disabling of inactive credentials to reduce the attack surface.
• ISO 27001 A.9.2.5: Requires review of user access rights and removal of unnecessary accounts.
• SOX: Calls for timely revocation of unused accounts to protect systems that impact financial reporting.

Inactive User Accounts: NetSuite System Capabilities

In most ERP systems, dormant accounts are tracked using last login date or last recorded activity. Some platforms make this easy by providing an inactivity lockout setting, automatically disabling accounts after a set period without use. In NetSuite and similar systems that lack a native auto-disable feature, administrators can run reports (Saved Searches in NetSuite) against login audit data, export the results, and filter for accounts exceeding the inactivity threshold defined by policy. This manual review, while not as seamless as automation, is still highly effective when performed on a set schedule.

Inactive User Accounts: Risk Considerations

The risks of ignoring dormant accounts are significant. Orphaned credentials from former employees can provide stealthy access to your NetSuite environment, bypassing standard onboarding and approval processes. Dormant privileged accounts are especially dangerous because of the high-risk capabilities these accounts often contain. If a malicious user or terminated employee is able to access a dormant privileged account, they could wreak havoc, enabling that individual to undermine key IT General Controls and IT Application Controls. And from an audit perspective, weak management of these accounts is a common finding that can easily be avoided with consistent controls.

Inactive User Accounts: Controls

• Quarterly Dormant-User Review: Generate and review a dormant account report every quarter, using last login or last activity data as the basis. This review should involve both IT security and business process owners to confirm whether accounts should remain active or be disabled. It can be integrated into your existing User Access Review (UAR) / recertification process, ensuring dormant accounts are addressed alongside broader access appropriateness reviews.
• Automated Alerts: Configure automated alerts to flag accounts that are approaching your defined inactivity threshold (e.g., 60 or 90 days without login). Alerts should be sent to IT security or the provisioning team for investigation, so accounts can be reviewed and disabled before they become long-term dormant risks.
• Automated Deprovisioning Control for Inactive Accounts: In some ERP systems, administrators can enable a native setting to automatically lock or disable accounts after a set period of inactivity. This removes the need for manual review and ensures dormant accounts are systematically disabled. However, NetSuite does not have a built-in automated deprovisioning or inactivity lockout feature. In NetSuite, this control must be implemented manually—either through periodic reporting of the Login Audit Trail and manual inactivation, or through a custom SuiteScript that disables accounts based on last login date. Where native automation is unavailable, detective controls like alerts and scheduled reviews become even more critical

Finally, every account change—whether deactivation, deletion, or role removal—should be documented with the reason, date, and approving authority. This not only provides evidence for audits but also strengthens accountability. Dormant account management may seem like a housekeeping task, but in practice, it’s a frontline defense against unauthorized access and a critical part of maintaining a secure and compliant NetSuite environment