NetSuite Administrator Security and 2FA Hardening Checklist
This checklist reviews NetSuite account security from an administrator's seat: authentication and 2FA, roles, integration credentials, login monitoring and data access. It is built for a quarterly access review or an audit request.
0 of 32 items complete
4 critical items still open - these are the highest-risk gaps.
Authentication
Roles
Integrations
Monitoring
Data access
The critical items cover how most account compromises and audit findings happen: shared or unprotected admin logins, tokens left live after people leave, and nobody reading the login trail.
Get your access review checked
Send us your exported role and user list (names removed if you prefer) and we will flag the roles that need 2FA and the permissions to remove.
Optional. The tool and every export work without this. No spam.
How to use it
Work through it once as a baseline with the security or audit lead, then repeat the monitoring and integration groups every quarter. Tick items with evidence: a screenshot of the 2FA roles page, the exported user list, the login audit search. Export the result to PDF or Excel and keep it with the review date, which is what auditors ask for. Items that need a decision, such as which extra roles require 2FA or whether to use IP rules, should be written into your access policy so the next review checks against it rather than starting again.
Where the controls live in NetSuite
2FA roles and their settings are at Setup > Users/Roles > Two-Factor Authentication Roles. Password rules are in General Preferences. Users and their roles are managed at Setup > Users/Roles > Manage Users and on each employee's Access subtab, which also holds Global Permissions. Integration records are under Setup > Integration > Manage Integrations, and tokens under Setup > Users/Roles > Access Tokens. The Login Audit Trail is at Setup > Users/Roles > User Management > View Login Audit Trail and can be saved as a search. IP address rules are a feature you enable and then configure for the company and roles.
Worked example
Before a SOX walkthrough, an admin exports the users with the Administrator role and finds five, two of them a shared 'admin' login used by a consultant. The shared login is replaced with a named user, and the consultant's old tokens are revoked from the Access Tokens list. The 2FA roles page shows the AP Manager role, which can edit vendor bank details, is not on the list, so it is added. A saved login audit search filtered to failed logins shows repeated failures from one IP against an integration user, traced to an expired password on a legacy connector that should have been on TBA.
Common mistakes
Assuming the Administrator role is the only one that needs 2FA, while roles that can change bank details or approve payments do not have it. Sharing an admin login with a partner. Leaving tokens live after an integration or employee leaves. Giving integration users full UI roles instead of Web Services Only roles. Granting Global Permissions on an employee record and forgetting they apply to every role that user has. Collecting login audit data but never reviewing it.
Frequently Asked Questions
Why is NetSuite 2FA not working?
Check that the device clock is synced for authenticator apps, that the user is on the role you think, and whether the role requires 2FA. Users can sign in with a backup code if they have one. An administrator can reset a user's 2FA settings so they enroll again. Check the Login Audit Trail for the exact failure.
Which NetSuite roles must use 2FA?
NetSuite requires 2FA for the Administrator role and other highly privileged roles when signing in to the user interface. You can add any other role on the Two-Factor Authentication Roles page. Good candidates are roles that change vendor bank details, approve payments, manage users or edit financial setup.
How do I get a user access report in NetSuite?
Use Setup > Users/Roles > Manage Users for a list of users and roles, or build an employee saved search showing name, role, login access, last login and global permissions. Export it to Excel for review. Combine it with System Notes on roles to show what changed since the last review.
What does Global Permissions on an employee record do?
Global Permissions, on the employee's Access subtab, grant permissions to that user in every role they hold, on top of each role's own permissions. They are useful for one-off needs but easy to forget during access reviews, so include them in every review and prefer a custom role where possible.
If you want security reviewers to ask NetSuite in plain English who holds which permissions and who logged in from where, on infrastructure you control, we can set that up.
Related Tools
NetSuite Token-Based Authentication Setup Checklist
Every step to configure token-based authentication for NetSuite REST, SOAP or RESTlet calls, from features and roles to tokens and test calls.
NetSuiteNetSuite Role Permission Matrix Worksheet
An editable worksheet that records which role holds which permission level on each record area and scores the access risk for review.
NetSuiteNetSuite User Access Request Form Template
A fill-in access request form for new, changed or removed NetSuite users, with role, subsidiary, segregation of duties review and approval lines.
NetSuiteNetSuite SuiteAnalytics Connect ODBC Setup and Troubleshooting Checklist
Check licensing, role permissions, driver bitness, DSN settings and the usual failure points when connecting Excel, Power BI or a warehouse to NetSuite over ODBC or JDBC.
More NetSuite tools
See all- NetSuite Saved Search Formula Generator
- NetSuite CSV Import Template Guide
- NetSuite Inventory Costing Method Reference
- NetSuite Month End Close Checklist
- NetSuite License Cost Estimator
- NetSuite Custom Record Design Spec Template
- NetSuite SuiteScript Deployment Handover Template
- NetSuite Sandbox and Release Change Log Worksheet
- NetSuite Script and Workflow Inventory Worksheet
Keep exploring
Free tools
- NetSuite Token-Based Authentication Setup ChecklistEvery step to configure token-based authentication for NetSuite REST, SOAP or RESTlet calls, from features and roles to tokens and test calls.
- NetSuite Manufacturing Go-Live ChecklistA 30 item checklist covering data, setup, costing, inventory, roles and cutover before you run production in NetSuite.
- Oracle Database 19c Security Hardening Checklist for ERPA 37 item hardening checklist for Oracle Database 19c under an ERP: accounts, privileges, network, unified auditing, data protection and patching.
ERP fixes and how-tos
- NetSuite Delete Integration: How to Remove an Integration Record and Its Token Access SafelyHow to delete or disable a NetSuite integration record and revoke its tokens safely: find what uses it, block it first, revoke access tokens, then remove it.
- Fix NetSuite INSUFFICIENT_PERMISSION ErrorINSUFFICIENT_PERMISSION means the role or script deployment lacks a needed permission. Learn how to find the exact missing permission and fix it fast.
- NetSuite Manufacturing Mobile: shop floor work orders and requirementsWhat the NetSuite Manufacturing Mobile app does for shop floor work orders, what features and roles it needs, how to enable it and where it falls short.
Runs with your ERP
- Configure One (Revalize) CPQ and Oracle NetSuite: quote and account syncHow Configure One (Revalize) CPQ syncs quotes, contacts and accounts with NetSuite through the Revalize Integration Hub, with data flows, setup and pitfalls.
- NetSuite Quality Management SuiteApp: inspections and nonconformanceWhat the NetSuite Quality Management SuiteApp does: inspection specs, queues, sampling and nonconformance workflows. Setup, pitfalls, alternatives and AI uses.
- NetSuite Manufacturing Mobile and Tablet MES for Shop Floor DataOracle's NetSuite Manufacturing Mobile gives operators a scanner and tablet interface for labor, completions, material moves and receipts. Setup and limits.
Guides
- ERP Security Best Practices GuideImplement comprehensive ERP security best practices covering access control, encryption, monitoring, and compliance aligned with NIST CSF and CIS Controls frameworks.
- Security Hardening for On-Prem AI Stacks: A Defense Contractor's GuideSecurity hardening for on-prem AI stacks: container isolation, model supply chain, prompt injection defenses, and audit logging for defense contractors.
- Security Review Checklist for Enterprise AI AgentsA security review checklist for enterprise AI agents: data residency, identity and access, prompt injection defense, logging, and vendor risk for manufacturers.
AI on your ERP
- AI agents for NetSuite manufacturing operationsAI agents for NetSuite manufacturing: WIP tracking, routing exceptions, and work order status grounded in SuiteQL, with human approval on anything that writes back.
- AI for NetSuite, Beyond the Built-In Text ToolsNetSuite's built-in AI covers text generation, not grounded answers on your own data. See how a private LLM over SuiteQL adds real Q&A and controls.
Integrations
- How to use ChatGPT with Oracle NetSuiteConnect ChatGPT to Oracle NetSuite: custom GPT actions, exports versus live access, enterprise data controls, and when a private model is the safer choice.
- How to add AI agents to Oracle NetSuiteHow to add AI agents to Oracle NetSuite: SuiteQL and REST tool layer, RESTlet writes, role-scoped tokens, human approval, and where a private model fits.