17.2 Security Questions
Key Takeaways
NetSuite prompts you to set up three security questions at the first login. The answers are a recovery control for a forgotten password and for selected sign-in conditions.
You may click Remind Me Later up to five times. After the fifth dismissal, you must set up the questions before login continues.
A new or different computer is a keyed reason NetSuite asks a security question before login. A new browser, a cleared cache, private browsing, a password reset, and more than 90 days since the last login are also documented triggers.
An incorrect password, merely holding a 2FA-required role, and changing the password while already signed in do not cause that new-computer prompt. A 2FA role skips the extra login question and is still asked the questions when resetting a forgotten password.
Five wrong answers during login lock you out for 30 minutes. Password reset allows 20 attempts. An administrator password reset erases the saved questions; a reset you complete yourself keeps them.
Why the questions exist
Security questions are a recovery control, not a second password you type every day. At the first login, Help prompts you to answer three security questions. Those answers verify you if you forget your password or sign in from a new browser or a new computer. NetSuite rarely asks them, so people forget the answers, and a forgotten answer can close self-service reset.
Only you can update your own questions. An administrator cannot type new answers for you. The questions and answers are shared across all NetSuite accounts tied to the same production account, so a casual answer in a sandbox is the answer production will expect later.
When NetSuite asks before login
Help's security-question details list the circumstances that put a question in front of login. A new or different computer is the case to recognize first:
- You attempt to log in from a new or different computer.
- You attempt to log in using a new browser.
- You attempt to log in after the browser cache has been cleared.
- You attempt to log in with the browser in private mode, also called incognito browsing.
- You forget your password and must reset it.
- It has been more than 90 days since your last login.
If you answer correctly, login continues and NetSuite emails the address you used, as notice that authentication succeeded. If you give five consecutive wrong answers to the security question during login, you are locked out for 30 minutes. NetSuite emails you and your account administrator about that failure.
The new-computer check, and the related browser, cache, and private-mode checks, do not apply when you are using a two-factor authentication role or a role with IP address restrictions or device ID restrictions. Help still prompts those users to set up security questions. It asks them to answer the questions if they forget their passwords. Holding a 2FA-required role is therefore a reason the extra login question is skipped, not a reason the question appears.
An incorrect password is a failed password. Five consecutive wrong passwords can lock you out for 30 minutes, and that lock is not a security question. Changing the password while you are already signed in does not ask a question on the way in. A self-service reset keeps the existing questions and uses them as proof inside the reset. Opening a 2FA-required role does not start the new-computer question.
How you set them up
At the first login, NetSuite asks you to answer the three questions. If you are short on time, Remind Me Later dismisses the prompt and lets you in. The next login asks again. You can dismiss the prompt up to five times. After that, you must set up the questions before login continues. That five-dismissal limit belongs to security-question setup. It is a different counter from the five times you may skip 2FA enrollment.
If you dismissed the prompt and want to finish early, use Update Security Questions in the Settings portlet. The same link is how you change the questions later. Help's steps are:
- Find the Settings portlet on the Home page. By default it is on the left side, and you may need to scroll. On a customized dashboard it can sit anywhere.
- Click Update Security Questions.
- Enter your current NetSuite password.
- In Question 1, Question 2, and Question 3, select questions whose answers you can remember.
- In Answer 1, Answer 2, and Answer 3, enter the answers. You must answer all three.
- Click Save.
Help rejects the save unless every rule below is met:
- You answer all three questions.
- Each answer is unique.
- Each answer is at least three characters long.
- You do not use your email address or your password as an answer.
- Answers are not case-sensitive, so changing capitalization is not a new answer and should not spend an attempt later.
- Answers are masked. Clear Hide Answers if you need to see the characters before you save.
When the save succeeds, NetSuite shows a confirmation and emails the address you used to log in. That mail is your record that the questions changed. If you did not request the change, treat the message as a reason to sign in and review the questions while you still can.
If you forget the answers
The easiest repair is while you are already inside NetSuite. Open Update Security Questions, select new questions or re-enter answers you still know, and save. You need the current password for that screen. People who wait until they are locked out of the password lose this path.
If a login or a reset is already asking and you cannot remember the answer, Help separates two attempt limits. You have five attempts when answering security questions during login. Five consecutive wrong answers lock you out for 30 minutes. You have 20 attempts to answer all three questions during password reset. Case does not matter, so do not spend an attempt by changing only the capitalization. If all 20 reset attempts fail, contact your account administrator.
What happens next depends on who resets the password:
- If you reset your own password, the existing questions and answers stay in place. The reset flow is asking you to prove you know them.
- If an account administrator resets your password, Help's forgotten-answers topic says the previously saved questions are erased. After that reset you must set the questions up again.
- The User Access Reset Tool also has its own Clear User's Security Questions action. After that action, the next login prompts you to set up new questions and answers. Use the forgotten-answers rule for an administrator password reset, and use the separate checkbox when the task on the screen is only to clear the questions.
If neither you nor the administrator can finish a reset, the administrator can contact Support. Designating the role as 2FA-required skips the extra question on a new computer. It does not skip the questions inside a forgotten-password reset, and it does not invent answers you have lost.
Customer Center and Web Store Shopper do not have to set the questions up. The same exemption covers Web Services, SuiteScript, SuiteAnalytics Connect, OpenID Connect (OIDC) Single Sign-on, and SAML Single Sign-on. Users on 2FA roles, and users on roles with IP address restrictions, still set the questions up and answer them when they forget a password.
| Trigger | What NetSuite asks | What you should have ready |
|---|---|---|
| New or different computer | Security question before login, unless the role is exempt | The saved answer |
| New browser, cleared cache, or private mode | The same pre-login question | The saved answer |
| More than 90 days since last login | Security question before login | The saved answer |
| Forgot Your Password | All three questions, 20 attempts | All three answers before the 60-minute link expires |
| Five wrong answers during login | A 30-minute lockout and email to you and the administrator | Wait, or ask an administrator to unlock access |
| Change Password while already signed in | No security question | The current password; existing questions stay |
| 2FA role, or an IP or device ID restriction, on a new computer | No extra security question | The second factor; questions still apply if the password is forgotten |
A laptop from home
You usually sign in from an office laptop, then open NetSuite on a home computer you have never used. Before login, NetSuite asks a security question because the computer is new. A wrong password, a password change you made while signed in, and a 2FA-required role are different events. If the role requires 2FA, Help skips this extra question and still expects the answers when you reset a forgotten password. You have five attempts on the login challenge. If you can still sign in on the office laptop, update the questions there. An administrator password reset means setting up three new questions afterward.
A user who usually signs in from an office laptop opens NetSuite on a computer they have never used, and the role is not exempt from security questions. What happens before login?
NetSuite shows a security question because the first password attempt was incorrect
NetSuite shows a security question because the role requires two-factor authentication
NetSuite shows a security question because the user changed the password earlier while already signed in
NetSuite asks the user to answer a security question before login
How many security questions does the first NetSuite login ask you to set up?
One question, reused for every later check
Three questions, and the save requires an answer to all three
Five questions, matching the number of Remind Me Later dismissals
Twenty questions, matching the password-reset attempt limit
During Forgot Your Password, how many attempts does Help allow for answering all three security questions?
Five attempts, followed by a 30-minute lockout, which is the login-challenge limit
Ten attempts
Twenty attempts
Unlimited attempts until the 60-minute email link expires
Sections you finish are checked off in the contents.