Your ERP holds the most sensitive financial, HR, and operational data in your organisation. In 2026, the IBM Cost of a Data Breach 2026 report puts the average cost of a data breach at $4.99 million — an all-time record, up 12% year on year. The Verizon DBIR 2026 adds another dimension: compromised credentials appear in 39% of breaches at some point in the attack chain, even when they are no longer the initial entry vector.
The question is no longer whether your ERP will be targeted, but how you will manage access before attackers do it for you. That is precisely what the Zero Trust model applied to ERP addresses: never trust a account by default — even an internal one, even behind a VPN. Always verify. Always restrict.
This guide is written for a CIO or CISO at a mid-market company who needs to move from theory to action — with concrete decisions on IAM, MFA, and PAM, and a 12-month roadmap.
1. Why Zero Trust Is Now Essential for ERP in 2026
The ERP Security Perimeter Has Collapsed
For a long time, ERP security rested on a clear network perimeter: the server sat in a machine room, users were in the office, and a VPN protected remote access. That model is obsolete.
In 2026, a typical ERP is exposed to:
- Multi-channel access: web interface, mobile app, API, EDI connectors, banking gateway
- Distributed users: remote workers, branch offices, integrator consultants on-site, supplier partners with portal access
- Third-party integrations: CRM, BI, e-commerce, HR platform, payroll tool, banking — every connector is an attack surface
In this context, trusting a user because they are “on the network” no longer means anything. A compromised external consultant account can traverse the entire information system without triggering a single alert if access is not properly segmented.
NIS2 and DORA: Specific Identity Requirements for ERPs
Two regulatory frameworks now impose concrete requirements on ERP access management:
NIS2 (transposed into EU member state law by 2025): Article 21(2)(j) of the directive requires multi-factor authentication “where possible”, with the implementation framework clarifying that the obligation covers at minimum all privileged access and all remote access to critical systems. Non-compliance penalties reach €10 million or 2% of global annual turnover for essential entities, with personal liability for executives and board members.
DORA (applicable since January 2025): for financial entities and their ICT service providers, DORA (Article 9) requires a documented access policy covering all accounts with access to information systems — including service accounts and API keys, not just human accounts.
The ERP is almost systematically classified as a “critical system” under both frameworks. Your IAM/PAM/MFA project is therefore not just a best practice — it is a regulatory obligation with a deadline that is already running.
Zero Trust: The Principle and What It Changes for ERP
Zero Trust does not mean “block everything”. It is a posture shift: instead of trusting a user because they presented a valid password from a recognised device, you continuously verify the context of every access — identity, device, location, behaviour — and grant only the rights strictly necessary for the duration strictly necessary.
Applied to ERP, this translates into three operational pillars:
- IAM (Identity and Access Management): who can access what, under which rules, with what audit trail
- MFA (Multi-Factor Authentication): strengthened identity proof at every sensitive connection
- PAM (Privileged Access Management): specific protection for high-privilege accounts — administrators, consultants, service accounts
2. IAM: The Non-Negotiable Foundations for Your ERP
2.1 SSO (Single Sign-On): Centralising Authentication
The first building block of a solid IAM is SSO: all authentications to the ERP go through a centralised corporate directory. Concretely, the user authenticates once against your Identity Provider (IdP), and the ERP recognises that session without asking for a second password.
The most widely deployed IdP solutions in mid-market organisations in 2026:
- Microsoft Entra ID (formerly Azure AD): dominant in Microsoft 365 environments, native integration with SAP, Dynamics 365, Business Central
- Okta: SaaS-agnostic solution, broad ERP connector catalogue (SAP, Odoo, NetSuite, Sage X3)
- Ping Identity: enterprise positioning, often selected in regulated sectors
Federated authentication protocols:
- SAML 2.0: the established standard, preferred by SAP Fiori, Sage X3, Microsoft Dynamics
- OAuth2/OIDC: more modern, used by Odoo (v16+), NetSuite, REST APIs
The choice of protocol matters: verify compatibility with your ERP version before selecting your IdP. An integrator who promises “SAML” on an Odoo Community instance without an IdP module probably hasn’t read the documentation.
Access certification reviews are the essential counterpart to SSO: if all access is centralised, you can also easily produce a quarterly report on “who has access to what in the ERP”. This report is the foundation for NIS2 and DORA access management controls. Without SSO, producing this report requires manual exports from each ERP module.
2.2 Automated Provisioning with SCIM
SCIM (System for Cross-domain Identity Management) is the protocol that automates the creation, modification, and deletion of ERP accounts based on HR events in your directory.
When an employee joins: as soon as the account is created in Active Directory or Entra ID with the correct profile (department, role, location), SCIM automatically provisions the ERP account with the rights corresponding to that job profile. The employee can work from day one, without a helpdesk ticket.
When an employee leaves: as soon as the HR account is disabled in the directory, SCIM disables the ERP account within minutes. This is the most security-critical scenario: a forgotten account after a departure is a perfect entry point for a disgruntled ex-employee or an attacker who has obtained the credentials.
Most major ERPs support SCIM in 2026: SAP S/4HANA (via SAP Identity Management or Entra ID), Microsoft Dynamics 365, NetSuite, Odoo Enterprise (v17+). For Sage X3, SCIM support often requires a middleware or integration connector.
3. MFA: What Your ERP Must Enforce
Criticality Levels and Authentication Requirements
Not all ERP modules carry the same level of risk. Zero Trust logic requires calibrating the authentication level to the sensitivity of the data and actions accessible:
| ERP Module | Criticality Level | Recommended MFA Requirement |
|---|---|---|
| Finance / Accounting | Critical | Mandatory MFA, phishing-resistant |
| HR / Payroll | Critical | Mandatory MFA, phishing-resistant |
| Purchasing / Vendors | High | Mandatory MFA |
| Admin / Configuration | Critical | Mandatory MFA + recorded session |
| Logistics / Production | Medium | MFA strongly recommended |
| Read-only (BI, reporting) | Standard | MFA recommended |
MFA Methods and Their Security Strength
Three levels of strength, from least to most secure:
SMS / OTP by SMS: still widely used, but explicitly discouraged by European regulators and non-compliant with a strict reading of NIS2. Vulnerable to SIM swapping and real-time phishing attacks (AiTM).
Authenticator app / TOTP (Time-based One-Time Password): Microsoft Authenticator, Google Authenticator, Authy. A solid security level for the majority of users. Push notification (with number matching verification) is preferable to classic TOTP to resist MFA fatigue attacks.
FIDO2 / Passkeys / hardware security keys: Yubikey, FIDO2-certified keys. The only level recognised as “phishing-resistant” by NIS2 guidance and ENISA recommendations. Mandatory for ERP administration accounts in environments subject to NIS2 or DORA.
Enabling MFA in Major ERP Platforms
SAP S/4HANA / Fiori: MFA is managed at the IdP level (Entra ID, Okta). SAP Cloud Identity Services (IAS) allows configuring adaptive authentication policies by user group. Activation does not touch ERP business logic and does not require an SAP version upgrade.
Microsoft Dynamics 365: MFA is managed by Entra ID. If your Microsoft 365 tenant is already configured with Entra ID P2 (approximately $10/user/month), Conditional Access lets you enforce MFA only for Dynamics access and calibrate requirements based on device and location.
Odoo 18: the web_enterprise module has included TOTP since v15. Activation is configurable by user group. SSO/SAML integration with Entra ID or Okta for centralised MFA requires the auth_saml module (available on the Odoo Apps Store for Community instances, native in Enterprise).
Sage X3: MFA relies on a third-party IdP via SAML. Sage recommends using Microsoft Entra ID or Okta for clients who already have these solutions. A Sage X3 configuration with SAML + FIDO2 is achievable but requires specific integration expertise.
Field Workers and Mobile Access
A maintenance technician accessing the ERP from an industrial tablet, a sales rep checking stock on their phone: MFA must work for them too, without blocking operational activity.
The most practical solution is the combination of Conditional Access + managed device (MDM). If the device is enrolled in your MDM (Microsoft Intune, Jamf) and compliant with the security policy, MFA can be satisfied by device possession (certificate). The user enters no additional code — verification is transparent.
4. PAM: Protecting ERP Superadmin Accounts
High-Risk Accounts That Are Consistently Underestimated
ERP administration accounts are rarely the ones that receive the most attention in audits. Yet they are the most dangerous when compromised:
- Database administrators (HANA, Oracle, SQL Server): direct access to ERP tables, ability to extract or modify any data without going through application-level controls
- ERP service accounts: used by overnight batch jobs, banking interfaces, EDI synchronisations — often with passwords that have not changed since the initial deployment
- Integrator consultant accounts: created for a project, often never deactivated after the engagement ends
- “BASIS” or ERP super-admin account: generic admin account shared among multiple administrators, with no individual audit trail
The Verizon DBIR 2026 research confirms that privileged accounts remain a central vector in sophisticated attacks: even when the initial intrusion exploits a vulnerability, escalation to a privileged account occurs in the vast majority of serious incidents.
What a PAM Solution Actually Does
A PAM (Privileged Access Management) solution addresses four problems specific to high-privilege accounts:
1. Password vaulting: privileged account passwords are no longer known to administrators. They are stored in an encrypted vault, automatically injected at connection via the PAM, and rotated according to a defined policy (every 24 hours, 7 days, etc.).
2. Session recording: every privileged account session is recorded (video + command logs). In the event of an incident, you know exactly what was done, by which account, at what time — even if the account was generic.
3. Just-In-Time access: rather than leaving admin rights permanently active, the PAM grants them only for the duration of the intervention, on explicit request, with an approval workflow. A consultant requesting DB access for a 2-hour intervention receives the rights only for those 2 hours.
4. Audit and reporting: automatic session exports, alerts on abnormal behaviour (login at 3am, access to an unusual table, abnormal extraction volume).
PAM Solutions on the Market and Indicative Budget
The three major enterprise PAM players in 2026:
CyberArk: the market reference, budget of $2,400 to $4,800 per privileged user per year for Privilege Cloud Standard (CyberArk Pricing 2026). Enterprise positioning, most complete feature set, longer deployment. Required for large-scale SAP environments.
BeyondTrust: 15 to 35% less expensive than CyberArk on comparable scopes. Strong on Windows PAM and admin workstation security. Well suited to Dynamics 365 and Microsoft-centric environments.
Delinea (formerly ThycoticCentrify): 30 to 45% less expensive than CyberArk, faster deployment. The recommended entry-level enterprise PAM for mid-market organisations of 100 to 500 users whose PAM needs do not justify CyberArk.
For a mid-market company with 10 to 20 privileged ERP accounts, a PAM budget of €25,000 to €60,000 per year (licensing + initial implementation) is realistic with Delinea or BeyondTrust. CyberArk on the same scope would start closer to €60,000–€100,000.
5. Zero Trust ERP Implementation Plan: 4 Phases Over 12 Months
A Zero Trust ERP project does not deploy in a weekend. It follows a logical sequence that avoids disrupting production while making rapid progress on the most critical risks.
Phase 1 (Months 1–2): Access Inventory and Mapping
Before any technical solution, you need to know what you are protecting:
- ERP account inventory: active accounts, dormant accounts (last login > 90 days), generic accounts, service accounts
- Rights mapping: who has access to which modules, which transactions, which legal entities
- Privileged account identification: all accounts with admin, DB, batch, or integration access
- External access census: consultants, auditors, partners with direct or VPN access
Deliverable: an ERP access matrix — the foundation of the IAM policy and PAM configuration.
Phase 2 (Months 3–4): Centralised SSO + MFA Activation
- Connect the ERP to your IdP (Entra ID, Okta depending on existing infrastructure) via SAML or OIDC
- Activate MFA starting with finance and HR accounts (maximum criticality), then extend to all users
- Configure SCIM for automatic provisioning of joiners and leavers
- Disable dormant accounts identified in Phase 1 (quick security win)
Main risk: legacy ERPs without SAML support. Plan for a middleware connector if needed, or handle the case via network-level Conditional Access while awaiting migration.
Phase 3 (Months 5–6): PAM for Privileged Accounts
- Deploy the PAM solution for administrator, DB, and service accounts
- Migrate passwords into the PAM vault (end of admin-known passwords)
- Enable session recording for all privileged ERP connections
- Implement Just-In-Time access for external consultants and contractors
- Train administrators on the new access workflows
Phase 4 (Months 7–12): Continuous Monitoring and Quarterly Review
- Integrate ERP/PAM into your SIEM (Splunk, Sentinel, Elastic) for event correlation
- Configure behavioural alerts: login outside usual hours, abnormal access volume, attempt to access unauthorised modules
- Quarterly access certification (mandatory under NIS2): automatic report from the IdP + manager sign-off
- Attack scenario testing: simulate a user account compromise, verify that PAM blocks privilege escalation
6. Budget and ROI: What Does a Zero Trust ERP Architecture Cost?
Indicative Costs for a Mid-Market Company with 100–300 ERP Users
| Component | Solution | Indicative Annual Budget |
|---|---|---|
| IdP / SSO | Entra ID P2 | ~$10/user/month (annual) |
| IdP / SSO | Okta Workforce Identity | ~$10–14/user/month |
| PAM (10–20 privileged accounts) | Delinea Secret Server | €20,000–40,000 (licensing) |
| PAM (10–20 privileged accounts) | BeyondTrust | €25,000–50,000 (licensing) |
| PAM (10–20 privileged accounts) | CyberArk Privilege Cloud | €50,000–100,000 (licensing) |
| IAM + SSO implementation | System integrator | €15,000–30,000 (one-off) |
| PAM implementation | System integrator | €20,000–40,000 (one-off) |
For a mid-market company with 150 ERP users and 15 privileged accounts, a total implementation budget of €80,000 to €120,000 (year-one licensing + professional services) is a realistic range with Delinea or BeyondTrust.
ROI: Comparing Against the Cost of a Breach
The IBM Cost of a Data Breach 2026 sets the global average breach cost at $4.99 million. For a mid-market European organisation, the cost is proportionally lower but includes:
- Incident response and system restoration costs
- Business interruption during remediation (billing blocked, production halted)
- GDPR notification to your national supervisory authority and affected individuals
- Potential NIS2 fines (up to 2% of global annual turnover for essential entities)
- Reputational damage and customer loss
A complete IAM/PAM/MFA project typically absorbs the equivalent of 2 to 3 weeks of avoided business interruption. For most mid-market organisations, the equation is favourable from the first year.
Funding and Incentive Programs
EU Digital Europe Programme: co-financing is available for cybersecurity projects in critical sectors through national Digital Innovation Hubs (DIHs). Check your country’s EDIH network for eligibility.
EU Structural Funds (ERDF): depending on your region and sector, European co-financing can cover up to 40% of qualifying cybersecurity investments under regional operational programmes.
National cybersecurity agency programmes: most EU member states have national SME cybersecurity grant or voucher schemes administered by agencies such as ENISA (EU level), NCSC (UK), BSI (Germany), or ANSSI (France). Check your national agency’s website for current programs targeting NIS2 compliance.
Zero Trust ERP Checklist: Where to Start Tomorrow Morning
If you had to take one action per pillar:
IAM: enable SSO between your ERP and your corporate directory. If Entra ID is already in place for Microsoft 365, the SAML configuration towards your ERP is often half a day’s work for an experienced administrator.
MFA: enable MFA on Finance and HR accounts in your ERP this week. These are the most targeted accounts, with the highest financial and regulatory exposure.
PAM: audit the passwords on your ERP service accounts. If a consultant worked on your last ERP project and their account has not been deactivated, deactivate it today.
Governance: schedule your first quarterly ERP access certification review. Export the list of active accounts, ask managers to confirm each account is legitimate. It’s free, auditable, and the foundation of every NIS2 compliance programme.
To deepen your ERP security strategy, read our ERP cybersecurity guide and our analysis of DORA compliance for financial sector ERPs. If you are running a NIS2 compliance project, our article on ERP segregation of duties controls covers the 12 controls to implement before your next audit.
