NetSuite Application and Operational Security

Role-Level Access

End users can be assigned roles with specific permissions and restrictions to see only the data, and use only the features, required for their jobs — right down to the field level. NetSuite provides a complete audit trail, tracking transactions by user login details and applying a timestamp to each change.

Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) is another layer of securing user access to your NetSuite account. In addition to a username and password, a role can be configured with an additional layer of protection where users provide a verification code. The verification code can be obtained from an authenticator app, or for example, by a message sent to a mobile phone.

Password Policies

Customers have granular password configuration options, ranging from the length of the passwords to the password expiration policy. They can set up strict rules to ensure that new passwords vary from prior passwords and that passwords are complex enough to include a combination of numbers, letters and special characters. In addition, accounts are locked out after several unsuccessful attempts.

Continuous Monitoring

NetSuite employs both network- and server-based Intrusion Detection Systems (IDSs) to identify malicious traffic attempting to access its systems. Security alerts and logs are sent to a security information and event management (SIEM) system for monitoring, and response actions, when required, are executed by an experienced, in-house security team.

Separation of Duties

In addition to mandatory employee background checks at all levels of the organisation, Oracle NetSuite follows the Principle of Least Authority (POLA) — employees are given only those privileges necessary to do their jobs.

Dedicated Security Team

Oracle NetSuite employs a global security team dedicated to enforcing security policies, monitoring alerts and investigating any anomalous system behaviour, including unauthorised connection attempts and malicious software. Near-real-time monitoring is in place with a 24x7 worldwide incident response capability. All access to production systems is approved and regularly reviewed by the security team.

Performance Audits

Oracle NetSuite implements auditing controls appropriate for SOC 1 Type II, SOC 2 Type II, ISO 27001 and PCI compliance, and employs a comprehensive risk management process modelled after the National Institute of Standards and Technology’s (NIST) special publication 800-30 and the ISO 27000 series of standards. Periodic audits ensure that personnel performance, procedural compliance, equipment serviceability, updated authorisation records and key inventory rounds meet or exceed industry standards.

Security Certifications

Oracle NetSuite issues reports upon the completion of periodic SOC 1 Type II and SOC 2 Type II audits and is certified for PCI DSS and ISO 27001:2013.

• Oracle NetSuite has defined its information security management system in accordance with NIST 800-53 and ISO 27000 series standards.
• Oracle NetSuite’s SOC 1 Type II and SOC 2 Type II audits are prepared and audited by independent third-party auditors. A SOC 1 Type II audit is essential to meeting the reporting requirements of Section 404 of Sarbanes-Oxley relating to the effectiveness of internal controls for financial reporting. A SOC 2 Type II audit reports on controls that directly relate to the security, availability and confidentiality of services organisations.
• The PCI DSS security standard is designed to ensure that companies process, store and transmit payment card information in a secure environment. Oracle NetSuite’s Attestation of Compliance (AOC) is prepared and issued by a PCI Qualified Security Assessor (QSA).

Privacy Certifications

Oracle NetSuite performs reviews and annual audits, conducts privacy risk management and oversees remediations, oversees privacy by design in technology and processes has a third-party vendor management program to ensure that the suppliers adhere to the privacy regulations, and is committed to maintaining and improving its privacy information management and data protection programs. Oracle NetSuite also provides Product Feature Guidance documents that describe how the service functionality is designed to assist customers with their privacy requirements.

• Oracle NetSuite has extended the ISO 27001 Information Security Management System to include the ISO 27018 control set, demonstrating protection and adequacy for processing Personal Information as a Public Cloud Hosting Provider.
• Oracle NetSuite’s adherence to the EU Cloud Code of Conduct (CoC) has been verified (Verification ID: 2021LVL02SCOPE218) and published on the monitoring body’s public registry(opens in a new tab). The CoC has been designed to define general requirements for cloud service providers as processor, demonstrating sufficient guarantees under Art. 28.1-4 of EU General Data Protection Regulation (GDPR).
• Oracle Corporate (Oracle EMEA Ltd) has obtained EU/EEA-wide authorisation from the European data protection authorities for its Binding Corporate Rules for Processors (“BCR-p”). This helps our customers address their privacy and security requirements under GDPR and other European data protection laws and regulations in the EU/EEA, the UK and Switzerland (“European Data Protection Law”). See the Privacy Code for Processing Personal Information of Customer Individuals (Oracle Processor Code)(opens in a new tab).