The 39 Salesforce security checks Black Cat runs
Black Cat SSPM evaluates 39 security policies against your Salesforce configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Salesforce — what access Black Cat needs, and why.
Identity, MFA & sign-in
15 checks · highest severity: critical
Access control & privilege
21 checks · highest severity: high
Identity, MFA & sign-in (15)
- Admin Without MFA severity: critical
- User Without MFA severity: high
- Weak Password Policy severity: high
- Password Never Expires severity: high
- No Password History severity: medium
- HTTPS Not Required severity: high
- CSRF Protection Disabled severity: high
- Weak Max Login Attempts severity: medium
- Short Lockout Interval severity: low
- Session Timeout Too Long severity: medium
- No Clickjack Protection severity: medium
- Sessions Not Locked to Domain severity: medium
- No Forced Logout on Session Timeout severity: medium
- High Failed Logins severity: medium
Access control & privilege (21)
- Inactive Admin severity: high
- Frozen Active User severity: medium
- User Never Logged In severity: medium
- Excessive Modify All Data severity: high
- Profile View All Data severity: medium
- Profile Manage Users severity: high
- API Access Review severity: info
- Permission Set Modify All Data severity: high
- Permission Set View All Data severity: medium
- Permission Set Manage Users Wide severity: high
- Permission Set API Access severity: medium
- Login From Multiple IPs severity: medium
- Active User Without Role severity: low
- Weak Password Complexity severity: high
- Permission Set Manage Malicious Files severity: medium
- Profile Manage Malicious Files severity: medium
- Profile Data Export severity: high
- Permission Set Data Export severity: high
- Profile Bulk API Hard Delete severity: high
- Permission Set Bulk API Hard Delete severity: high
Other checks (3)
severity: high Public Sharing Model fix difficulty: medium #
Restrict org-wide default sharing to Private or Public Read Only for sensitive objects
- Go to Setup > Security > Sharing Settings
- In the "Organization-Wide Defaults" table, locate the flagged object
- Click "Edit" next to the object
- Change the "Default Internal Access" from "Public Read/Write" to "Private" or "Public Read Only"
- Click "Save" — Salesforce will recalculate sharing rules, which may take time for large orgs
- Review and update any sharing rules under Setup > Security > Sharing Settings to grant access where legitimately needed
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: critical External Access Read Write fix difficulty: medium #
Restrict external (community/guest) access for objects currently set to Read/Write to prevent unauthorized CRM data modification
- Go to Setup > Security > Sharing Settings
- In the "Organization-Wide Defaults" table, locate the flagged object
- Click "Edit" next to the object
- Change the "Default External Access" from "Public Read/Write" to "Private" or "Public Read Only"
- Click "Save" — sharing rule recalculation may take time for large orgs
- Review Experience Cloud site sharing rules and guest user profiles to ensure community users retain only the minimum required access
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: low Unused Permission Set fix difficulty: easy #
Delete or archive permission sets with no assignees to reduce configuration sprawl
- Go to Setup > Users > Permission Sets
- Click the flagged permission set
- Verify no users are assigned under "Manage Assignments"
- If the permission set is no longer needed, click "Delete"
- Document any permission sets retained for future use
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10