Why A Strong Password Policy Matters

Think of your NetSuite environment like your company’s HQ. If the front door is flimsy, it doesn’t matter how many security cameras or motion sensors you have—someone’s going to stroll in and help themselves to your sensitive data, financial data, or, if the account happens to be privileged, potentially grant themselves keys to the kingdom and wreck mayhem in any way they see fit. That’s why password security isn’t just a “nice to have,” it’s a must-have, especially if you’re subject to SOX compliance. The NIST SP 800-63B guidelines, basically the “how to do passwords right” manual, state the following:

1. Minimum 12-character passwords
2. Blocking of common or compromised strings
3. Avoiding unnecessarily complex composition rules (to encourage user adoption of stronger passphrases)
4. Prohibiting password reuse

Section 404 of the Sarbanes-Oxley Act (SOX) requires effective authentication controls for systems impacting financial reporting. The stakes are high: if your password policy is weak, it could be a control failure that lands you in your auditor’s hall of shame.

In NetSuite, the place to set password policy configurations is within the General Preferences page. To get there, head to Setup ➜ Company ➜ General Preferences, and scroll down to the Password Policy section. This is your command center for controlling who can get in and how hard it is for the bad guys to guess their way inside.

The options here are straightforward but powerful. You can set a password policy which is three levels to select from being:

1. Strong: Minimum length 10 characters; must include at least 3 of 4 character types: uppercase letters, lowercase letters, numbers, and non-alphanumeric ASCII characters.
2. Medium: Minimum length 8 characters; must include at least 2 of 4 character types: uppercase letters, lowercase letters, numbers, and non-alphanumeric ASCII characters.
3. Weak: Minimum length 6 characters; no character type requirements.

The password policy will determine the minimum character length admins will need to set for the Minimum Password Length setting, but they can set any number of characters above what is required by the policy they have selected. The Password Expiration In Days field will determine how many days must pass before users are required to reset / change their password.

If you want to align with NIST’s playbook, set the bar at 12 characters. Thankfully, NetSuite inherently enforces certain NIST-aligned password requirements through hard-coded logic, including prohibiting password reuse, requiring significant differences from prior passwords, and blocking easy-to-guess strings or common words.

Not properly configuring password policy settings in NetSuite, or any ERP system for that matter, is the equivalent to leaving the keys under the welcome mat. Weak passwords open the door for credential stuffing (where hackers try stolen passwords from other sites) and social engineering attacks, such as phishing, that could lead to financial fraud or data loss. Once someone’s in, privilege escalation can happen fast—and suddenly you have a bunch of ghost accounts with privileged access.

The fix is simple and here are some of our control recommendations:

1. Configure your password policy to align with NIST’s 12-character recommendation. While NIST advises avoiding overly complex composition rules, we recommend keeping the policy at the Strong level unless it creates an undue burden on your IT team from frequent password reset requests.
2. Turn on lockout alerts – this can be done via a saved search with specific conditions that trigger alerts
3. Periodically review the Login and Login Failure audit trail reports
4. Periodically review the General Preferences audit trail
5. Make sure only small, authorized group of admins can configure the General Preferences page.

We would recommend a quick chick in monthly over the General Preferences page and the General Preferences audit trail to make sure no one’s quietly lowered the bar in an unauthorized manner.

Here’s an example of the General Preferences Audit Trail:

Finally, remember that password policy isn’t “set it and forget it.” It’s like changing the batteries in your smoke detector, you’ve got to check it regularly if you actually want it to work when it counts. From an audit perspective, SOX testing should confirm your settings match your baseline, and internal audit teams should check that IT security teams are reviewing them regularly.