ERP security: request evidence, not badges

Define the data and access model

Classify the information the ERP holds and assign owners. Test how roles restrict transactions, reports, search and exports. Include service accounts and integrations in the inventory. Separation between legal entities or departments should be demonstrated with test users, not assumed from a settings screenshot.

Read the scope of assurance

If a vendor supplies a certificate or assurance report, check the legal entity, covered service, dates, scope and exceptions. Obtain current evidence through the appropriate process. A badge does not prove that every product feature or deployment environment falls within the same assessment.

Test recovery and incident ownership

Ask for backup and recovery procedures, evidence of exercises and an incident communication path. Clarify customer responsibilities and the process for revoking compromised access. Align recovery targets with operational needs, including shop-floor activity during a prolonged interruption.

Review AI and third-party data flows

Identify external model providers, subprocessors and data-processing locations. Ask how prompts and attachments are retained and whether they are used for training. Document deletion and export behavior. Keep unanswered questions visible in procurement rather than treating a marketing statement as a completed security assessment.

Start with an abuse and error scenario

List the business events that would cause material harm: a changed supplier bank account, an unauthorized credit, disclosure of margins, deleted tracking history or an account that remains active after departure. Include accidental actions as well as deliberate misuse. Map each scenario to preventive permissions, approval controls, detection and recovery. Give the process owner a concrete test rather than asking IT whether the system is secure in general. Identify which controls belong to the application and which depend on identity services or internal procedures. The resulting scenario register provides a defensible scope for evidence requests and avoids treating a long collection of badges as a complete assessment.

Test effective permissions across every access path

Create a restricted user, a supervisor, an administrator and an integration identity in a sandbox. Try the same sensitive record through navigation, search, report, export, API and any AI assistant included in scope. Check changes as well as reads. A user who cannot open a supplier page might still be able to export its bank fields through a report if roles are poorly designed. This is a test hypothesis, not a claim about a particular product. Microsoft's Business Central documentation distinguishes entitlements and permission sets. That product-specific distinction reinforces the need to inspect effective access, including extensions, rather than assuming a license assignment defines a complete authorization model.

Examine a consequential master-data change

Illustrative example: a purchasing user requests a supplier payment-detail amendment. Have a different authorized role review it and verify the prior value, new value, requester, approver and time. These are fictional test roles. Attempt to bypass the intended process using import or an integration account. Inspect what is logged and who can alter logging settings or delete records. Decide how an investigator retrieves the evidence without relying on the person whose action is being reviewed. If the application requires an external logging or approval component, include that dependency and its retention in the scope. A visible history panel is useful only if it records the events your control needs.

Read assurance with the service boundary beside it

Request current assurance material through the provider's appropriate disclosure process. Check the named organization, service, period and exclusions; ask how exceptions relevant to your deployment are addressed. Separate infrastructure assurance from application and implementation responsibilities. A report may describe controls without evaluating your configured roles, partner extension or local operating practices. Do not publish confidential report details or imply an independent certification review that has not occurred. Record the evidence received, review owner, findings and follow-up date. Where material is unavailable, document the gap and choose another way to evaluate the requirement, such as a focused technical workshop or contract clarification.

Rehearse containment and restoration together

Ask how a compromised service account is disabled and how affected transactions are identified. Identify contacts authorized to declare an incident, preserve evidence and communicate with operations. Test the effect of revocation on queued integrations and active sessions. Then rehearse restoration and reconciliation with fictitious transactions. A recovered database may need connectors, identity settings and outbound jobs reviewed before it is usable safely. Business Central's restore documentation provides a concrete example of product-specific recovery limitations. For the selected configuration, obtain the applicable procedure and verify it with the responsible team. Keep recovery objectives tied to operational consequences rather than to an unexplained industry benchmark.

Turn assessment into recurring ownership

Maintain an inventory of privileged and nonhuman identities, external data recipients, extensions and critical interfaces. Assign a reviewer and review trigger for each. Triggers can include staff departure, a new country, an AI feature, a partner change or a major update. Document who checks alerts and how unresolved exceptions reach a decision maker. Include deletion and export tests in lifecycle planning so data handling remains understandable at exit. The practical handover consists of a control scenario register, effective-access tests, assurance review notes, incident contacts and recovery evidence. It should explain the remaining responsibilities clearly enough that a new administrator can operate the controls without the original procurement team.

Common questions

Continue your research

The following profiles provide a starting point for checking vendor-described scope. Inclusion is not a ranking or a statement that every requirement is supported.