Ensuring that users have only the access they need—no more, no less—is critical for both security and compliance. Organizations must find a way to safeguard sensitive data, demonstrate compliance, and prevent privilege creep.
What is a User Access Review?
User Access Reviews (UARs) are periodic reviews of user access across applications, like NetSuite, for appropriateness. Executing periodic UARs is a key security control that adheres to the Principle of Least Privilege, helping ensure that a user’s access aligns to their current role. UARs are guided by regulatory frameworks including GDPR, HIPAA, SOX, and PCI-DSS.
An effective User Access Review answers questions like:
- Who has access to NetSuite?
- What can they do with that access?
- Does this access match their current job requirements?
- Are there any high-risk or conflicting permissions?
- Should this access be changed or removed?
- Can we demonstrate to an auditor that this review happened?
An access certification campaign is the structured, time-bound instance of the review process. Many organizations struggle with UARs because the access certification process can be very manual and time-consuming. Introducing automation for access certification is a smarter, faster way to meet compliance requirements and reduce risk.
Why is access certification needed?
When was the last time someone raised their hand and asked you to remove their access?
Even if your security controls were well-designed when implementing NetSuite, access needs evolve, and excessive access accumulates. Employees regularly change roles, take on temporary assignments, or transfer between departments, often without their old permissions removed.
Over time, this leads to “privilege creep”, where users accumulate more access than their job requires. Conducting regular User Access Reviews as part of an access certification campaign helps keep NetSuite access aligned with current job responsibilities.
What makes access certification so time-consuming?
The answer is manual processes, plain and simple. In organizations, the IT department is usually responsible for the administration of access certification campaigns. Here is what the manual process might look like for an IT administrator:
- Collect user accounts and access from disparate systems
- Prepare system extracts for review
- Distribute Excel spreadsheets to appropriate reviewers
- Manage delegations, rerouting, and mapping errors
- Notify reviewers and follow up for timely submissions
- Interpret reviews, ensure completeness, and follow up
- Aggregate and distribute access removals to respective team(s)
- Validate access removals
In addition to the time it takes to prepare data and identify reviewers, IT admins often spend a lot of time tracking progress in spreadsheets and following up with reviewers to ensure they complete their review.
What makes user access reviews in NetSuite unique?
-
Out-of-the-box roles are over-permissive: Native roles prioritize functionality over security, often granting users excessive access beyond their actual duties. This misalignment increases the risk of segregation of duties (SoD) conflicts and makes it harder to enforce least privilege.
- Lack of description field for roles: Many applications/systems have descriptions of roles, making it easier to understand the purpose of each role. This missing context can make access reviews more challenging, as reviewers must rely on naming conventions or external documentation to understand the role’s intent.
Description missing below:
- Multi-subsidiary and multi-entity access: Users in NetSuite can be assigned access to multiple subsidiaries, which makes reviewing access more complex. Having another layer of cross-entity visibility can increase the risk of excessive access if not carefully reviewed.
How much time can automation realistically save?
On average, customers of Fastpath, now part of Delinea, have reported reduced time spent on access certifications is 80%.
“Tracking each individual manager, what they’ve done, and whether they’ve responded correctly was completely manual. Once we implemented and got the Fastpath Access Certification product set up, we saved 100 man-hours right off the bat.”
~ John Jezek, Business Systems and Release Manager, ChemTreat
“Fastpath saved us enough time for our team to take on an additional 7 system UARs— translated to a savings of approximately 300 hours a year.”
~ Director of IT Compliance, Norwegian Cruise Lines Holdings
Fastpath Access Certification integrates directly with NetSuite, along with other business applications in scope for review, and retrieves user and access information automatically. IT admins can implement automated workflows and use pre-built email templates to streamline delivery of review requests and automatically nudge reviewers, reducing time spent on reminders and follow-ups. They can also see the status of each certification in a centralized dashboard view—no more spreadsheets.
Most importantly, Fastpath, now part of Delinea, has earned the trust of audit firms for over 20 years, giving customers confidence that every User Access Review report is complete and accurate.