Is Your ERP Actually Ready for Go-Live?
25 essential security controls to verify across identity, infrastructure, database privacy, disaster recovery, and API integrations before your Odoo or cloud ERP goes into production.
What Actually Happens When ERP Go-Live Is Rushed?
In 80% of enterprise ERP implementations, the commercial pressure to meet an arbitrary "Go-Live Date" leads leadership to bypass fundamental cybersecurity controls. Project managers declare: "The accounting entries balance, the invoices print, and the factory can ship—we will fix security after go-live."
This is the exact moment catastrophic operational vulnerabilities enter the business:
A disgruntled sales executive or third-party contractor exports your complete customer list, profit margins, and supplier pricing via unmasked Excel export buttons.
Direct PostgreSQL port 5432 or exposed SSH keys allow automated botnets to encrypt production transactional databases with zero uncorrupted offline backups.
Unrestricted administrative access allows users to alter approved vendor bank accounts, backdate sales returns, or bypass commercial credit checks.
The CISO's Mandate: A pre-flight checklist is not an obstacle to go-live; it is the insurance policy that guarantees your ERP remains operational, legally compliant, and protected from corporate extortion.
The 5 Pillars of Enterprise ERP Security
Arihant AI structures ERP go-live readiness across five distinct architectural domains. Every single control must produce verifiable documentary evidence before production sign-off:
Identity & Access Governance
Controls 01 to 05: MFA enforcement, least-privilege RBAC, segregation of duties (SoD), and superuser decommissioning.
Network & Perimeter Security
Controls 06 to 10: WAF rate limiting, reverse proxy hardening, IP whitelisting for backends, and TLS 1.3 encryption.
Database & Data Privacy
Controls 11 to 15: Non-production database masking, PostgreSQL isolation, encrypted rest storage, and DPDP compliance.
High-Availability Disaster Recovery & Backup Verification Architecture
Controls 16 to 20: Automated off-site immutable backups, RTO/RPO verification, point-in-time recovery (PITR), and tested failover runbooks.
Application, Integration & Telemetry
Controls 21 to 25: API token lifecycle, webhook boundaries, Chatter audit logging, security alerting, and tested incident response.
The CISO's Pre-Flight Checklist: 25 Essential Controls
Every control below must be evaluated, owned by a responsible leader, and supported by concrete audit artifacts prior to releasing production ERP URLs to staff:
| # | Domain | Security Control | Verification Procedure | Evidence Required | Owner |
|---|---|---|---|---|---|
| Domain 1: Identity & Access Governance | |||||
| 01 | Identity & Access | Mandatory Multi-Factor Authentication (MFA) | Enforce TOTP / WebAuthn for all internal users. Zero exceptions for executives. | Odoo `auth_totp` audit report | IT Head |
| 02 | Identity & Access | Decommissioning of Default 'admin' Account | Rename default admin UID 1, disable public login, rotate password to 32-char vault key. | SQL query on `res_users` UID 1 | CISO |
| 03 | Identity & Access | Role-Based Access Control (RBAC) Hardening | Verify employees have access only to their departmental business objects (Least Privilege). | Odoo ACL matrix export | ERP Lead |
| 04 | Identity & Access | Segregation of Duties (SoD) Verification | Ensure users who create purchase orders cannot approve them or issue vendor payments. | SoD conflict matrix scan | CFO / Internal Audit |
| 05 | Identity & Access | Export Restriction on Customer / Financial Data | Disable generic Excel/CSV export button for non-managerial staff across contacts and invoices. | Odoo `base.group_allow_export` review | ERP Lead |
| Domain 2: Network, Perimeter & Infrastructure | |||||
| 06 | Network & Perimeter | Web Application Firewall (WAF) & DDoS Shield | Deploy Cloudflare / AWS WAF with rate-limiting rules on `/web/login` and JSON-RPC. | WAF active policy configuration | Infra Lead |
| 07 | Network & Perimeter | PostgreSQL Direct Port (5432) Isolation | Verify database binds strictly to `localhost` or private VPC subnet. Zero public IP exposure. | Nmap scan & `netstat -tlpn` | Infra Lead |
| 08 | Network & Perimeter | Strict TLS 1.3 Encryption & HSTS | Configure A+ SSL configuration with TLS 1.3, modern ciphers, and HTTP Strict Transport Security. | SSL Labs A+ Certificate Report | Infra Lead |
| 09 | Network & Perimeter | Database Manager & Debug Mode Lockdown | Block `/web/database/manager`, disable master database password, and restrict debug modes. | HTTP 403 response on `/web/database/selector` | ERP Lead |
| 10 | Network & Perimeter | Linux Host Hardening & SSH Key-Only Access | Disable SSH password login, enable UFW firewall, fail2ban, and unattended security patches. | SSH `sshd_config` audit output | Infra Lead |
| Domain 3: Database Security, Encryption & Privacy | |||||
| 11 | Database & Privacy | Automated Staging Database PII Scrubbing | Ensure QA and development copies mask all customer names, phones, emails, and bank accounts. | Post-sanitization DB clone report | CISO |
| 12 | Database & Privacy | Encryption at Rest for Database & Filestore | Verify PostgreSQL tablespaces and Odoo filestore (`/data/filestore`) live on encrypted volumes (LUKS/EBS). | Volume encryption status confirmation | Infra Lead |
| 13 | Database & Privacy | Outbound Email / SMS Server Decoupling in Staging | Neutralize mail servers in non-production environments to prevent accidental emailing of real clients. | SQL check: `ir_mail_server` inactive | ERP Lead |
| 14 | Database & Privacy | Data Retention & Log Archival Policy | Define statutory retention windows for invoices (8 years) and purge transient session logs. | Scheduled cron job definition | Legal / CFO |
| 15 | Database & Privacy | DPDP Act / GDPR Privacy Compliance Audit | Audit employee and customer consent records, grievance redressal, and right to be forgotten. | Privacy impact assessment sign-off | CISO |
| Domain 4: Business Continuity & Disaster Recovery | |||||
| 16 | Disaster Recovery | Automated Daily Off-Site Immutable Backups | Encrypted WAL archiving & database dumps stored in air-gapped, write-once object storage (S3 Object Lock). | S3 bucket replication log | Infra Lead |
| 17 | Disaster Recovery | Real-World Backup Restore Verification Test | Perform complete restoration of production backup onto completely fresh hardware and verify data integrity. | Documented DR drill completion log | CISO |
| 18 | Disaster Recovery | Recovery Time (RTO) & Recovery Point (RPO) SLA | Establish business RTO (<2 hours) and RPO (<15 minutes) with WAL archiving mechanisms. | Signed Executive SLA Document | COO / CFO |
| 19 | Disaster Recovery | High Availability (HA) & Failover Runbook | Document step-by-step procedure to redirect DNS to secondary cold/warm disaster recovery node. | Tested Emergency Failover Runbook PDF | Infra Lead |
| 20 | Disaster Recovery | Uninterruptible Power & Factory Edge Continuity | Verify factory barcode scanners and IoT weighing scales have offline buffer queues during network outages. | Edge disconnection stress test log | Plant Head |
| Domain 5: Application, API Integration & Telemetry | |||||
| 21 | Application & API | API Authentication & Token Lifecycle Governance | Ensure all external integrations use OAuth2 / scoped API keys with mandatory 90-day rotation. | Active API key registry audit | ERP Lead |
| 22 | Application & API | Integration Endpoints Restricted by IP Whitelist | Lock banking webhooks, e-way bill gateways, and 3PL shipping APIs to verified upstream IP ranges. | Nginx IP restriction ruleset | Infra Lead |
| 23 | Application & API | Privileged Action & Chatter Audit Logging | Log all master record deletions, credit limit overrides, and bank account changes to immutable audit tables. | Odoo `mail.tracking.value` sample output | CISO |
| 24 | Application & API | Continuous Monitoring & Security Anomaly Alerts | Configure automated Prometheus/Grafana or SIEM alerts for brute-force logins and sudden CPU spikes. | Active alert trigger test screenshot | Infra Lead |
| 25 | Application & API | Incident Response & Escalation Playbook | Define the 1-hour containment protocol, legal notification chain, and forensic snapshot procedure. | Signed CISO Incident Response Plan | CISO |
Stop the Go-Live If You Find Any of These 6 Red Flags
If your technical implementation partner or internal IT team presents any of the following six conditions, do not sign the go-live authorization under any circumstances:
Multiple consultants or department heads log in using the same master administrator account or default passwords.
The test/UAT server contains an unmasked clone of production customer phone numbers, GSTINs, or email addresses.
Backups exist on disk, but the IT team has never actually restored the backup onto an independent server to prove it works.
PostgreSQL is listening on 0.0.0.0, allowing any IP on the internet to attempt brute-force dictionary attacks.
Any clerk or operator can select 10,000 customers or stock levels and download an unrestricted Excel file to personal laptops.
Payment gateway secret keys, SMS API tokens, or cloud access keys are hardcoded directly into custom Python modules or GitHub.
Automated Pre-Flight Security Inspection Architecture
Arihant AI utilizes an automated pre-flight security inspection daemon that programmatically validates these controls directly against the live Odoo database:
Independent VAPT & Questions for Your Odoo Partner
Never let the implementation team grade their own homework. An independent Vulnerability Assessment & Penetration Testing (VAPT) audit must inspect application business logic prior to go-live:
What ERP VAPT Must Test
- Parameter Tampering: Can an external portal customer change sales order line prices to negative values during checkout?
- Privilege Escalation: Can an internal employee alter URL parameters (e.g. `id=...`) to inspect salary slips or management accounts?
- SQL Injection: Are custom search queries and reporting filters sanitized against SQL injection attacks?
- Session Fixation: Are user session cookies properly rotated upon login and invalidated upon password change?
5 Questions for Your Odoo Partner
- "Can you provide written proof that our test database does not email real customers?"
- "Who has SSH root access to our production server, and how is it audited?"
- "What is our verified RTO/RPO, and when was the last successful test restore?"
- "Are our custom Python modules scanned against OWASP Top 10 security standards?"
- "Is database manager `/web/database/manager` completely disabled from the public internet?"
Industry-Specific ERP Security Risks
Primary Risk: Bill of Materials (BOM) theft and production stoppage during shifts due to unencrypted edge communication.
Primary Risk: Batch formulation leaks, missing audit trails for batch releases, and regulatory 21 CFR Part 11 non-compliance.
Primary Risk: Bulk export of customer credit limits and competitor price books by sales staff moving to competing firms.
Primary Risk: Unrestricted access to client confidential tax audits, payroll data, and banking transaction histories.
The Formal Go-Live Gate: Who Must Sign Off?
An ERP deployment should never proceed without unanimous, written sign-off from all four enterprise gatekeepers:
Ensure Your Odoo ERP Is Genuinely Production-Ready.
Do not gamble your company's operational continuity on unverified assumptions. Our certified cybersecurity and ERP architects will audit your 25 essential controls, execute an independent VAPT assessment, and deliver a formal Go-Live Readiness Certificate.
- 25-Control Comprehensive Architecture Review
- Independent OWASP & Logic VAPT Assessment
- Real-World DR Backup Restoration Drill
- Non-Production PII Masking Verification
- Board-Level Go-Live Risk & Sign-Off Report