Skip to content

Salesforce identity, MFA & sign-in security checks

Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.

On Salesforce, Black Cat runs 15 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Salesforce connector needs.

Checks (15)

severity: critical Admin Without MFA fix difficulty: easy #

Enroll MFA for all admin accounts via Salesforce Identity Verification settings

  1. Go to Setup > Identity > Identity Verification
  2. Under "Multi-Factor Authentication for UI Logins", enable MFA for the System Administrator profile
  3. Navigate to Setup > Users > Profiles and select the affected admin profile
  4. Click "Edit", scroll to "System Permissions", and ensure "Multi-Factor Authentication for User Interface Logins" is checked
  5. Save the profile and notify the affected admin to register an MFA authenticator app on next login
  6. Verify enrollment by checking the user record under Setup > Users > Users

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high User Without MFA fix difficulty: easy #

Enable MFA for all active users via Identity Verification settings

  1. Go to Setup > Identity > Identity Verification
  2. Enable "Multi-Factor Authentication for UI Logins" for the relevant user profiles
  3. Navigate to Setup > Users > Profiles, select each profile used by standard users
  4. Click "Edit" and check "Multi-Factor Authentication for User Interface Logins" under System Permissions
  5. Save and communicate to users that they must register an authenticator app on next login
  6. Monitor enrollment progress under Setup > Identity > Identity Verification

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high Weak Password Policy fix difficulty: easy #

Strengthen the org password policy to require minimum 12-character alphanumeric passwords with 90-day expiry

  1. Go to Setup > Security > Password Policies
  2. Set "Minimum Password Length" to 12 or higher
  3. Set "Password Complexity Requirement" to "Must mix alpha and numeric"
  4. Set "Maximum Password Age" to 90 days or less
  5. Set "Minimum Password Age" to 1 day to prevent rapid cycling
  6. Click "Save" to apply the new policy org-wide

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high Password Never Expires fix difficulty: easy #

Set a password expiration period so that credentials are rotated regularly and compromised passwords are invalidated

  1. Go to Setup > Security > Password Policies
  2. Locate the "Maximum Password Age" field
  3. Change the value from "Never expires" to 90 days or less (e.g., "90 days")
  4. Set "Minimum Password Age" to 1 day to prevent users from immediately cycling back to a previous password
  5. Click "Save" to apply the policy org-wide
  6. Notify users that they will be required to reset their password on or before the expiry date

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium No Password History fix difficulty: easy #

Enforce password history to prevent users from reusing recent passwords after a forced rotation

  1. Go to Setup > Security > Password Policies
  2. Locate the "Password History" field
  3. Set the value to 3 or higher (recommended: 5)
  4. Click "Save" to apply the policy org-wide
  5. Combine with a password expiration policy to ensure regular rotation with no reuse

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high HTTPS Not Required fix difficulty: easy #

Require HTTPS for all Salesforce sessions to prevent session token interception over unencrypted connections

  1. Go to Setup > Security > Session Settings
  2. Locate the "Require secure connections (HTTPS)" option
  3. Check the box to enforce HTTPS for all sessions
  4. Click "Save" to apply the setting
  5. Verify that all custom domains and community portals are also configured with valid TLS certificates

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: high CSRF Protection Disabled fix difficulty: easy #

Enable CSRF protection to prevent cross-site request forgery attacks against authenticated Salesforce sessions

  1. Go to Setup > Security > Session Settings
  2. Locate the "Enable CSRF protection on GET requests on non-setup Salesforce pages" option
  3. Check the box to enable CSRF protection
  4. Click "Save" to apply the setting
  5. Test any custom Visualforce pages or Lightning components that make GET requests to confirm they are unaffected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.6 NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: medium Weak Max Login Attempts fix difficulty: easy #

Lower the maximum login attempts threshold to 5 or fewer to reduce brute-force attack exposure

  1. Go to Setup > Security > Password Policies
  2. Locate the "Maximum Invalid Login Attempts" field
  3. Set the value to 5 or lower
  4. Set an appropriate "Lockout Effective Period" (minimum 15 minutes recommended)
  5. Click "Save" to apply the policy org-wide
  6. Monitor Login History for lockout events to detect active brute-force attempts

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: low Short Lockout Interval fix difficulty: easy #

Increase the account lockout duration to at least 15 minutes to slow automated brute-force attacks

  1. Go to Setup > Security > Password Policies
  2. Locate the "Lockout Effective Period" field
  3. Set the value to 15 minutes or longer
  4. Click "Save" to apply the policy org-wide
  5. Pair this with a maximum login attempts limit of 5 or fewer for full brute-force protection

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium Session Timeout Too Long fix difficulty: easy #

Reduce session timeout to 120 minutes or less via Session Settings

  1. Go to Setup > Security > Session Settings
  2. Locate the "Timeout Value" dropdown under "Session Settings"
  3. Select "2 hours" (120 minutes) or a shorter value
  4. Optionally enable "Force logout on session timeout" for stricter enforcement
  5. Click "Save" to apply the new timeout value

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: medium No Clickjack Protection fix difficulty: easy #

Enable clickjack protection for Salesforce pages via Session Settings

  1. Go to Setup > Security > Session Settings
  2. Scroll to the "Clickjack Protection" section
  3. Check "Enable clickjack protection for Setup pages"
  4. Check "Enable clickjack protection for non-Setup Salesforce pages"
  5. Optionally enable protection for customer Visualforce pages if applicable
  6. Click "Save" to apply the settings

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: medium Sessions Not Locked to Domain fix difficulty: easy #

Lock sessions to the domain they originated from to prevent session reuse across domains

  1. Go to Setup > Security > Session Settings
  2. Locate the "Lock sessions to the domain in which they were first used" option
  3. Check the box to bind each session to its originating domain
  4. Click "Save" to apply the setting
  5. Verify that Experience Cloud sites and custom domains continue to function as expected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 NIST CSF 2.0 PR.AA-01 NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: medium No Forced Logout on Session Timeout fix difficulty: easy #

Force logout on session timeout so idle sessions are terminated rather than only warned

  1. Go to Setup > Security > Session Settings
  2. Locate the "Force logout on session timeout" option under Session Settings
  3. Check the box to terminate idle sessions instead of only displaying a warning
  4. Click "Save" to apply the setting
  5. Confirm an appropriate "Timeout Value" is also configured (120 minutes or less)

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 NIST CSF 2.0 PR.AA-01 NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: high Session Cookies Not HttpOnly fix difficulty: easy #

Mark session cookies HttpOnly so session IDs are not exposed to client-side script (XSS theft)

  1. Go to Setup > Security > Session Settings
  2. Locate the "Require HttpOnly attribute" option under Session Settings
  3. Check the box to set the HttpOnly attribute on session cookies
  4. Click "Save" to apply the setting
  5. Verify that any custom JavaScript that reads session cookies is updated accordingly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 NIST CSF 2.0 PR.AA-01 NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5

severity: medium High Failed Logins fix difficulty: medium #

Investigate accounts with excessive failed logins and enable login IP restrictions to prevent brute-force attacks

  1. Go to Setup > Security > Login History to review failed login attempts for the flagged user
  2. Determine whether the failures indicate a brute-force attack or a legitimate locked-out user
  3. If suspicious activity, temporarily freeze the account under Setup > Users > Users
  4. Enable login IP ranges under Setup > Users > Profiles > (profile name) > Login IP Ranges to restrict access to known IP addresses
  5. Consider enabling Salesforce Shield Event Monitoring for ongoing anomaly detection
  6. Notify the user and reset their credentials if account compromise is suspected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

More Salesforce checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial