What is Multi-factor Authentication (MFA)
Multi-Factor Authentication (MFA) is a security control that requires users to verify their identity with more than one method....
Reviewing User Access to Sensitive Data in NetSuite
Why User Access to Sensitive Data Should Be Restricted
Restricting user access to sensitive data in NetSuite isn’t just good security, it’s essential for meeting data privacy compliance objects and stakeholder trust. Information like employee Social Security Numbers, payroll details, or company bank accounts should only be seen by the few people who truly need it. NetSuite’s role-based permissions make it possible to control who can access this kind of information, but those permissions can drift over time. That’s why organizations should leverage the User Access Review (UAR) process to make sure no inappropriate user or roles have access to such data.
Identifying Which Roles and Permissions Grant Access to Sensitive Data
A good review starts by identifying which roles and permissions grant access to sensitive data, confirming that users with those roles actually need it for their jobs, and removing inappropriate permissions from any role or user who doesn’t. These reviews should happen periodically, especially for high-risk areas like HR, Payroll, and Finance.
Here are a few examples of how access should be structured in NetSuite:
| Sensitive Data Type |
Example Permissions | Who Should Have Access |
| Bank Account Information | View Unencrypted ACH Account Numbers (Bundle Permission) | Controller, Treasurer, or Accounting Manager roles responsible for payment processing. |
| Payroll Data | Payroll Check Register or Form W-2 – Wage and Tax Statement | Payroll Managers or HR Directors who handle payroll operations. |
| Social Security Numbers (SSNs) | Employee Social Security Numbers | HR Administrators or Compliance Officers responsible for tax filings or background checks. |
Reviewing User Access to Sensitive Data
When reviewing access, focus on the principle of least privilege—users should only have access to what they need to perform their duties. Leverage access control reports from an assessment provider (e.g., ERP Armor: Assessments for NetSuite) or GRC software to identify users and roles that have access to sensitive data.
In short, protecting sensitive data in NetSuite isn’t a one-time setup—it’s an ongoing responsibility. Regular access reviews help prevent data exposure, keep your organization compliant, and ensure that only trusted users and roles have visibility into your most confidential information.
