# ERP Security Posture Checklist: 30 Controls That Protect Your System of Record > Source: https://netray.co/tools/erp-security-posture-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Work through 30 concrete security controls across access, patching, network, data protection, and monitoring, with the highest-risk items flagged. ## Category erp-operations ## Tool **Kind:** checklist **Groups:** #### Access Control and Identity **Items:** **Text:** Every ERP user has an individual named account; no shared or generic logins exist, including on shop-floor terminals **Critical:** true **Text:** A documented joiner-mover-leaver process deactivates ERP access within one business day of termination **Critical:** true Segregation of duties is enforced for high-risk combinations (vendor create + payment, PO create + receipt approval) Privileged and admin accounts are separate from daily-use accounts and limited to named individuals **Text:** Multi-factor authentication protects remote and administrative access to the ERP **Critical:** true User access rights are recertified by business owners at least annually #### Patching and Vulnerability Management **Items:** The ERP application is within vendor support and receives security updates on a defined cadence **Text:** The underlying database and operating system are patched monthly or on a documented risk-based schedule **Critical:** true A tested rollback procedure exists for ERP and database patches Third-party components around the ERP (web servers, integration middleware, report servers) are included in patch scope Vulnerability scans cover the ERP servers and are reviewed, not just archived End-of-support dates for ERP version, database, and OS are tracked with funded upgrade plans #### Network and Infrastructure **Items:** **Text:** ERP servers sit on a segmented network zone, not flat with office and shop-floor networks **Critical:** true Direct ERP database access is restricted to application servers and named administrators; no user ODBC connections to production **Text:** Remote access to ERP infrastructure requires VPN or equivalent with MFA; no ports exposed to the internet **Critical:** true Service accounts use least-privilege rights and are not domain administrators Integration endpoints (APIs, file drops, EDI) are authenticated and encrypted in transit A current network diagram exists showing every system that talks to the ERP #### Data Protection and Backup **Items:** **Text:** ERP backups run on a schedule that meets a defined RPO, and completion is verified daily **Critical:** true **Text:** At least one backup copy is offline, immutable, or otherwise unreachable from a compromised domain **Critical:** true A full ERP restore has been tested within the last 12 months and the time recorded Production data is masked or scrubbed when refreshed into test and dev environments Database encryption at rest is enabled where the platform supports it Export-controlled and customer-sensitive data (ITAR, CUI, pricing) has documented handling rules within the ERP #### Monitoring and Response **Items:** Failed logins, privilege changes, and after-hours admin activity in the ERP are logged and reviewed ERP and database logs feed a central log platform or SIEM rather than staying on the local server An incident response plan names who decides to isolate or shut down the ERP during a suspected compromise Alerting exists for backup failures, service outages, and unusual data-export volumes Security responsibilities for the ERP are explicitly assigned to a named person, not implicitly to 'IT' Third-party vendors and consultants with ERP access are inventoried, time-limited, and reviewed quarterly **Scoring Note:** Score yourself honestly: an item counts only if it is true today and you could show evidence. Critical items represent the controls most commonly exploited in real manufacturing breaches; any unchecked critical item deserves remediation ahead of everything else, regardless of your overall percentage. ## Content **Intro:** This free ERP security posture checklist walks IT leaders and plant managers through 30 concrete, evidence-based controls that protect the system holding your orders, BOMs, pricing, and financials. It is organized into five domains (access control, patching, network, data protection, and monitoring) with the highest-risk items explicitly flagged as critical. It is written for manufacturers running Infor SyteLine, LN, Baan, and similar on-prem or hosted ERP systems, where a compromise does not just leak data; it stops production. Work through it in fifteen minutes and you will know exactly where your system of record is exposed. **Sections:** #### How the checklist is built and scored **Body:** Each item is a binary, evidence-based control: either it is true today and you could demonstrate it to an auditor, or it is unchecked. The critical flags mark the eight controls that map most directly to how manufacturing ERP environments actually get compromised: shared logins that defeat accountability, unpatched internet-adjacent services, flat networks that let ransomware jump from a phishing victim's laptop to the ERP database, and backup sets reachable from the same compromised domain they are meant to protect. Your percentage matters less than your critical-item count. A 70 percent score with two open critical items is a worse position than 55 percent with all criticals closed, because attackers exploit specific gaps, not averages. #### Why manufacturing ERP is a priority target **Body:** Manufacturers have become a top-targeted sector for ransomware precisely because downtime is unaffordable: when the ERP is encrypted, shipping stops, and attackers price their demands accordingly. ERP environments compound the exposure in predictable ways. **Bullets:** - Long upgrade cycles leave many plants running ERP versions, databases, or operating systems past security support - Shop-floor culture normalizes shared terminals and generic logins, erasing the audit trail identity controls depend on - Decades of integrations (EDI, label printing, quality systems, spreadsheets with embedded credentials) create unmapped pathways into the database - Backups are frequently online and domain-joined, which is why modern ransomware crews encrypt or delete them first #### Interpreting your results and sequencing remediation **Body:** Triage in three passes. First, close every unchecked critical item; most (MFA on remote access, backup immutability, deactivation discipline, network segmentation of ERP servers) are configuration and process work measured in weeks, not capital projects. Second, address the cheapest remaining items in access control and monitoring, because they compound: named accounts make log review meaningful, and log review makes every other control verifiable. Third, schedule the structural items (patching cadence, segmentation redesign, version upgrades) into the budget cycle with the checklist as your evidence. Re-run the checklist quarterly; posture decays through staff turnover and new integrations, and a falling score is the earliest warning you will get. #### How Netray hardens ERP environments **Body:** Netray secures ERP environments from inside the application, which is where generic security vendors stop. We remediate at the ERP layer: rebuilding role models with segregation of duties, eliminating shared logins without disrupting shop-floor workflows, locking down direct database access that legacy reports and spreadsheets depend on, and re-architecting integrations onto authenticated APIs. On the infrastructure side we implement segmentation, immutable backup patterns, and ERP-aware log monitoring, and because we support SyteLine, LN, and Baan daily, hardening lands without breaking MRP, EDI, or month-end. For aerospace and defense clients we align the same controls to CMMC and ITAR handling requirements, so one remediation effort serves both security and compliance. **Cta:** Spend fifteen minutes on the checklist now; it is considerably cheaper than the incident retrospective version. **Faq:** #### Which items should we fix first if resources are tight? **Answer:** The critical-flagged items, in roughly this order: an offline or immutable backup copy with a tested restore, MFA on all remote and admin access, elimination of shared logins, same-day deactivation of departed users, network segmentation of ERP servers, and patch currency on anything internet-adjacent. These six controls interrupt the most common real-world attack chains against manufacturers and are mostly process and configuration work rather than major purchases. #### Our ERP is on-prem and not exposed to the internet. Are we already safe? **Answer:** No, and this assumption is how most manufacturing ERP incidents start. The typical path is a phishing email compromising an office workstation, credential theft, and lateral movement across a flat network to the ERP database, none of which requires the ERP itself to be internet-facing. Segmentation, least-privilege service accounts, restricted database access, and unreachable backups are exactly the controls that break that chain, which is why they carry critical flags. #### How does this checklist relate to CMMC or NIST requirements? **Answer:** It is deliberately aligned but not a substitute. The access control, monitoring, and data protection items map directly onto NIST 800-171 families that CMMC assesses, so closing them advances both security and compliance simultaneously. However, CMMC additionally requires documented policies, evidence collection, and formal assessment scope. Defense suppliers should treat this checklist as the practical hardening layer and pair it with a proper gap assessment against the applicable CMMC level. ## Search terms ERP security checklist, ERP security best practices, SyteLine security hardening, ERP access control audit, manufacturing ERP cybersecurity, ERP ransomware protection, segregation of duties ERP --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json