Make it a habit to follow best practices to better ensure effective, audit-ready security for Sage 100.
If you’re the person who grants permissions in Sage 100, you’ve definitely run into permissions issues before. Perhaps you even ran into one this month. Sometimes, it’s hard to figure out why Salvador can’t access a certain printer. Other times, it’s unclear why Sandi can’t view a report you sent her. And Ted? Well, for a while there, you thought he’d never be able to upload an invoice.
But you figured out which permissions to grant them so they could complete their tasks with minimal fuss.
Which means now you really have to make sure that you followed these best practices.
1. Set up roles carefully, then adjust permissions as needed
You know about roles in Sage 100, so I won’t belabor this point. Basically, I want to make sure you remember that when you define roles, attach permissions to them, and assign them to users, you later adjust those permissions for each role as needed. Never grant full access to individual users to quickly and conveniently solve issues.
By adjusting existing role permissions as issues arise, you help ensure they’re correct for new hires. Bonus: this makes onboarding easier. (High five!)
2. Grant only the minimum access
Figure out the least permissions each role needs to do their job. (Auditors will love you for it.)
Also, limit the number of admins to as few people as possible. This can be frustrating, but it’s so worth it if your new AP clerk has their credentials stolen in a phishing scam. If you set them up as a Default user because it was fast and easy… well, now their hacker is a Default user, too.
3. Review permissions every six months
Newer versions of Sage 100 will show you an audit trail of changes, deletions, and additions to role and user information, so you can see who changed what and when. This helps you quickly scan through which users may have received upgraded access since your last check.
You don’t need to make this a full-day task. A quick glance over each user is enough. Here’s what you’re looking for:
- The employees who picked up temporary duties and never lost their increased access
- Overlapping roles that add up to either full access or way too much access
4. Stay on a supported version of Sage
Sage supports the current year’s version and the two before it. When Sage releases a new version, typically each April, the oldest one loses support. This doesn’t mean they stop working, just that you’ll have to get your Sage partner to support them. You may also run into integration stability issues and miss out on critical patches.
Check Sage’s supported versions page to look up your version, or count back two years from this one. (Example: In 2028, versions 2027 and 2026 are supported. If it’s the year 3274, versions 3273 and 3272 will be supported, and Sage 100 will be better than ever!)
5. Secure your entire environment
True security in Sage 100 depends on your whole environment: your Windows server, remote access tools, workstations, SQL server, ODBC connections, and add-ons. Keep all of those items up to date and patched, and make redundant backups that you test regularly.
If you host Sage 100 on your own servers, you’ll need strong internal controls and an IT professional to maintain them. If you work with (or are considering) a Sage 100 hosting provider, find out how they handle security.
Either way, you’ll want to know about:
- Multi-factor authentication (MFA)
- Backups
- Administrator and consultant access
- How quickly you can add new hires and remove employees who have left
This Week’s To-Dos for Security in Sage 100
Don’t wait on security. Instead, take these two simple steps this week:
- Bring up your user list and check each role against what the user actually does
- While you’re in there, check your version and make sure it’s still supported
If you find that your roles and permissions are way off, or that you’re on an unsupported version, my team and I can help. At VBCC, we’ve been supporting Sage users for more than 30 years, so we’ve got you covered. Need Help? Reach Out to VBCC
