System Health Check

The Health Check assesses your org's configuration against Salesforce's recommended settings for baseline security and produces a single score on a scale of 1-100%. When running the health check, you'll get a report of your org's current settings, presented against Salesforce's recommended values, with the option to adjust any settings that don't match Salesforce's recommendations.

To run a Health Check, do the following:

• From Setup, search for Health Check
• Salesforce will automatically scan your org for common configuration issues and present these broken into risk categories: High, Medium, or Low
• Prolocity recommends you aim to achieve 90% if possible...
  • ...but use discretion when reviewing the items that negatively impact this score and make informed decisions. Some items, such as enabling Log in as User may be required in your environment for support purposes. Additionally, enabling some items like Clickjack protection are desirable, but can cause issues with third party integrations or packages, like the UnofficialSF Data Table component.
• Click Edit on any of the items to be taken to the appropriate setup page to adjust your configuration. 
• Once your configuration has been updated, you can return to the security review and refresh your page to see an updated score.
• Items listed as Critical will have a higher impact on your score, so prioritize fixing those issues first. 
• For example this Org currently allows for 10 invalid login attempts before locking the user out. Salesforce recommends 3.

Password Policies

• If you complete the Health Check, then you should have already reviewed your Password Policies. However it’s recommended to spend a little extra time here to make sure your password policies are as secure as possible.
• Password Policies can be found by searching for them within Setup

If you do not use Single Sign On for your users, you can adjust password policies in Salesforce, such as the number of days between required password changes, or the required password length and complexity. Note that there are probably no truly right answers here; for instance, there is controversy over how often users should be required to change passwords (if at all).

Check for Active, but Idle User Accounts

Stale user accounts pose security risks for a number of reasons; first and foremost, those users may have left your organization without being properly deactivated, which means they could still have access to your organization. But even if the user is still at your organization, leaving an unneeded account active presents an opportunity for an attacker to compromise it and gain access to your data.

The goals of doing a review of user accounts are to note potential issues and

• • Determine the reasons why an idle user has not logged into Salesforce
  • Determine whether or not idle users still need a Salesforce license
  • Deactivate any users who no longer need access, which you can do by referring to this guide on deactivating users

Here are the steps to perform a user check:

• Navigate to your Users list within Setup.
• Make sure you are viewing an All Users list view.
• If not already configured, make sure to add the Last Login field to your User list view.
  • Click Edit next to View: All Users to adjust the fields displayed
  • Add Last Login to the fields displayed
  • Save
• You should now be able to view and sort by the last date/time your users logged into Salesforce and identify any users who have not logged into Salesforce recently
  • You can determine your own acceptable range but we recommend focusing on those that haven't logged in within the past three months

Review Licensing

After you've reviewed your users, it makes sense to quickly check your licensing. Reviewing licensing has two goals; one, it helps save money to ensure that users who may no longer need access to Salesforce, or who have left your organization, are no longer active. And second, it can help ensure that you have sufficient licenses for planned user growth

• Navigate to Company Information in Setup
• Here you can view your total, used, and remaining license counts for each license type. 
• The standard Salesforce license is important to keep an eye on. If you are a Nonprofit Salesforce customer, you will receive 10 licenses for free, but anything after those 10 will be charged for. 
• If you are at or close to your license limit, you may need to consider purchasing additional licenses, which an admin can do via the Your Account app directly in Salesforce

Multi-Factor Authentication

If you don't use a third-party single sign on like Google, Microsoft Azure, or Okta, Salesforce's terms of service require users who log in via the web browser or mobile apps to use Multi-Factor Authentication on Salesforce's end–usually using Salesforce Authenticator. Salesforce first added this to its usage policy several years ago and has, over time, ratcheted up technical enforcement by prompting users to set up an MFA method when they log in. As a result, almost all of your users should be compliant by now, but it is a good idea to check–especially because there are ways to grant exemptions to particular user accounts (usually integration users that are required for third-party tool integrations). Here's how to check to ensure users have set up MFA methods:

• Navigate to the User listing in setup (you just did this to check login history)
• Click Edit next to the list view drop-down menu
• Add Time-Based One-Time Password App and Salesforce Authenticator columns to the list view
• Ensure that each user has at least one method set up

Organization-Wide Defaults Configuration

Organization-Wide Defaults determining the baseline for record visibility in Salesforce. It is recommended that you ensure these Organization-Wide Defaults are configured correctly for your specific organization. For example, you can set Opportunities to be only viewable by their owners and their managers by setting the default visibility to Private, or make them visible to all users by making them Public Read Only. It's a good idea to review these defaults from time to time to make sure they meet your business and security needs. here's how to do so:

• Navigate to Sharing Settings in Setup.
• Here you can review all of your default visibility settings for each objects records in Salesforce. 
• Ensure that the core objects you use in your Salesforce org are correctly configured to meet your own security and sharing needs. 
  • Public Read/Write - Any user in Salesforce will be able to see and edit records of this object
  • Public Read Only - Any user in Salesforce will be able to read records of this object
  • Private - Only the record owner and users higher in the role hierarchy can have access to records of this object

Note that making changes here, especially converting from Public to Private, will affect your users' ability to see or edit records that they may need access to! Consider very carefully testing any changes in a sandbox before making them in your production org to avoid headaches for users (and yourself!).

Data Exports/Backups

It is recommended that every Salesforce org have a Data export protocol and owner determined. Salesforce offers an internal Data Export tool. If you do not already have a backup tool or process implemented, you should start ASAP. You can also consult our PRO Tips article on Data Backup for more details. The first tool that many orgs use, however, is Salesforce's Data Export, which enables you to schedule a CSV-based export of all of your Salesforce data:

• Navigate to Data Export in Setup
• If you have not recently backup up your Salesforce data, it is recommended you first Export Now to take a full backup of your data
• When configuring your export, you can choose which objects to include, as well as if you want to back up images, attachments, files, etc. We recommend including everything if you have never taken a backup before
  • Note, exporting images, attachments and files will significantly increase the number and size of backup files, and the amount of time it takes for the export to complete
• Once your one-time backup is configured, click Save to begin the export
• Once the export has completed, you will receive an email with a link to the files you will need to download (you can also access the download links by refreshing the Data Export home page)
  • Your backup will consist of at least one (many times multiple) zip files. Each file is capped at 500 MB
  • Each file will need to be downloaded and safely stored. We recommend saving a copy of the backup file to your computer as well as to a cloud based/online storage system such as google drive or Microsoft 365 if you have them
  • Note: you must download the file from Salesforce within 48 hours of completion of the export; after that time, the file will be deleted and you would have to run another export