# Epicor Security Group Design Worksheet

> Source: https://netray.co/tools/epicor-security-group-design-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An editable worksheet to plan security groups by role and score each for exposure, so over-broad access is visible before audit.

## Category

epicor

## Erp

Epicor Kinetic

## Industry

Discrete Manufacturing

## Audience

- Epicor administrator
- IT manager
- Internal auditor

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Security group

**Key:** group

**Type:** text

#### Business function

**Key:** function

**Type:** text

#### Users

**Key:** users

**Type:** number

#### Data sensitivity (1-5)

**Key:** sensitivity

**Type:** number

#### Write menus

**Key:** write

**Type:** number

#### SoD conflict?

**Key:** sod

**Type:** select

**Options:**

- No
- Review
- Yes

#### Group owner

**Key:** owner

**Type:** text

#### Last review

**Key:** review

**Type:** date

#### Exposure score

**Key:** exposure

**Type:** number

**Expr:** users * sensitivity + write

**Format:** integer

**Rows:**

**Group:** SHOPFLOOR_USER

**Function:** Labor and quantity reporting

**Users:** 45

**Sensitivity:** 1

**Write:** 3

**Sod:** No

**Owner:** Production manager

**Review:** 2026-09-15

**Group:** PLANNER

**Function:** MRP, job entry, scheduling

**Users:** 6

**Sensitivity:** 3

**Write:** 12

**Sod:** Review

**Owner:** Materials manager

**Review:** 2026-09-15

**Group:** BUYER

**Function:** Purchase orders and suppliers

**Users:** 5

**Sensitivity:** 4

**Write:** 10

**Sod:** Review

**Owner:** Purchasing manager

**Review:** 2026-08-30

**Group:** AP_CLERK

**Function:** Invoice entry and matching

**Users:** 3

**Sensitivity:** 4

**Write:** 8

**Sod:** Yes

**Owner:** Controller

**Review:** 2026-08-30

**Group:** ERP_ADMIN

**Function:** System and security administration

**Users:** 2

**Sensitivity:** 5

**Write:** 40

**Sod:** Yes

**Owner:** IT manager

**Review:** 2026-10-01

**Totals:**

#### Total seats

**Key:** users

**Agg:** sum

**Format:** integer

#### Highest exposure

**Key:** exposure

**Agg:** max

**Format:** integer

**Summary:**

#### Average exposure per group

**Key:** avg_exposure

**Expr:** sum_exposure / count

**Format:** decimal

**Notes:** Exposure is a simple planning score, users times sensitivity plus the number of write menus. It helps rank groups for review and is not an Epicor-calculated figure. Confirm actual group setup in Security Group Maintenance for your version.

## Content

**Intro:** Security groups drift. People change roles, groups gain menus nobody removes and one administrator account ends up doing everything. A worksheet that scores each group makes the riskiest ones obvious.

**Sections:**

#### How to use the worksheet

**Body:** List each security group, its business function, how many users hold it and how sensitive its data is on a one to five scale. Count the write menus it grants, mark any segregation of duties concern and assign an owner. The exposure score ranks groups, so you can start your review with the highest numbers and set a review date for each.

**Bullets:**

- One group per job function, not per person
- A named business owner for every group
- Review dates and evidence kept
- SoD conflicts flagged and mitigated

#### Design principles

**Body:** Give users the minimum menus and companies needed for their function. Build groups around roles such as planner, buyer and shop floor user, then assign users to one or a small number of groups. Avoid copying one user's access to another. Keep administrative rights in a small dedicated group and use named accounts.

#### Segregation of duties

**Body:** Typical conflicts include creating a supplier and approving its payments, entering and approving purchase orders, and adjusting inventory and counting it. Where small teams cannot separate duties, document compensating controls such as a periodic review of changes. Mark these rows so they are reviewed more often.

#### Common mistakes

**Body:** Granting a broad group to fix one urgent request, never removing access when staff move, sharing generic accounts and forgetting integration users. Also review who can modify BAQs, BPMs and security itself, since those rights can bypass many other controls.

**Cta:** We can help review user access exports and flag outliers, and keep any AI access to your Epicor data within the same role rules.

**Faq:**

#### How many security groups should we have?

**Answer:** As few as your roles require. Most manufacturers need a modest set of role-based groups for shop floor, planning, purchasing, finance, sales and administration. Too many near-identical groups become hard to review, and too few create over-broad access.

#### Where do I manage Epicor security groups?

**Answer:** Security groups are maintained in the Security Group Maintenance area, where menus, companies and options are assigned, and users are added in User Account Maintenance. Exact screen names can vary by version, so check your own menu.

#### How often should access be reviewed?

**Answer:** At least annually, and more often for finance and administrative groups or after reorganizations. Many audit programs expect quarterly review for the most sensitive groups, with evidence of who reviewed and what changed.

#### What about API and integration users?

**Answer:** Treat them as real users. Give each integration its own account with the narrowest security group and record the owner. Shared admin accounts for integrations are a common audit finding and hard to trace.

## Search terms

epicor security group design, epicor security groups best practice, epicor role based access, epicor segregation of duties, epicor user security audit, epicor menu security, epicor kinetic security setup, epicor security worksheet

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json