Skip to content

Salesforce access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Salesforce, Black Cat runs 21 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Salesforce connector needs.

Checks (21)

severity: high Inactive Admin fix difficulty: easy #

Deactivate or reassign admin accounts inactive for over 90 days

  1. Go to Setup > Users > Users
  2. Search for the flagged admin user by name or username
  3. Click "Edit" next to the user record
  4. Uncheck the "Active" checkbox to deactivate the account
  5. If the admin role must remain, reassign it to an active user under Setup > Users > Users
  6. Save changes and confirm the user no longer appears in active admin lists

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Frozen Active User fix difficulty: easy #

Resolve inconsistent frozen-but-active user state by deactivating or unfreezing the account

  1. Go to Setup > Users > Users
  2. Locate the flagged user account
  3. If the user should no longer have access, click "Edit" and uncheck "Active" to deactivate the account
  4. If the user is a legitimate active employee, click the user's name, then click "Unfreeze" to restore normal access
  5. Save changes and confirm the user state is consistent (either fully active or deactivated)

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium User Never Logged In fix difficulty: easy #

Review and deactivate active user accounts that have never logged in to remove orphaned or stale provisioning

  1. Go to Setup > Users > Users
  2. Search for the flagged user by username
  3. Confirm with the user's manager whether the account is still required
  4. If the account is no longer needed, click "Edit" and uncheck "Active" to deactivate it
  5. If access is still required, verify the user received their credentials and resend the welcome email if necessary
  6. Document the resolution and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Excessive Modify All Data fix difficulty: medium #

Remove Modify All Data permission from profiles where it is not strictly required

  1. Go to Setup > Users > Profiles
  2. Click the name of the flagged profile to view its details
  3. Click "Edit" to modify the profile
  4. Under "Administrative Permissions", uncheck "Modify All Data"
  5. Review other broad permissions (e.g., "View All Data") and remove if unnecessary
  6. Save and verify the change by reviewing the profile's permission summary

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Profile View All Data fix difficulty: medium #

Remove View All Data permission from profiles where broad data visibility is not required

  1. Go to Setup > Users > Profiles (Enhanced Profiles UI)
  2. Click the name of the flagged profile
  3. Navigate to "System Permissions" and click "Edit"
  4. Uncheck "View All Data" to remove the permission
  5. Review sharing rules under Setup > Security > Sharing Settings to ensure users still have appropriate access to their own data
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Profile Manage Users fix difficulty: medium #

Remove Manage Users permission from profiles where user administration is not a required function

  1. Go to Setup > Users > Profiles (Enhanced Profiles UI)
  2. Click the name of the flagged profile
  3. Navigate to "System Permissions" and click "Edit"
  4. Uncheck "Manage Users" to remove the permission
  5. Identify which users hold this profile and confirm with their managers that user management is not part of their role
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Profile Author Apex fix difficulty: medium #

Remove Author Apex permission from profiles where server-side code development is not required

  1. Go to Setup > Users > Profiles (Enhanced Profiles UI)
  2. Click the name of the flagged profile
  3. Navigate to "System Permissions" and click "Edit"
  4. Uncheck "Author Apex" to revoke the permission
  5. Confirm with the development team that no active users in this profile require Apex authoring rights
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: info API Access Review fix difficulty: easy #

Review and disable API access on profiles where programmatic access is not required

  1. Go to Setup > Users > Profiles
  2. Click the name of the flagged profile
  3. Click "Edit" to modify the profile
  4. Under "Administrative Permissions", uncheck "API Enabled" if API access is not required for this profile
  5. Save the profile and validate that affected users can still perform their job functions via the UI

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Permission Set Modify All Data fix difficulty: medium #

Remove Modify All Data from permission sets or restrict which users it is assigned to

  1. Go to Setup > Users > Permission Sets
  2. Click the name of the flagged permission set
  3. Click "System Permissions" in the left sidebar
  4. Click "Edit" and uncheck "Modify All Data"
  5. Save the permission set
  6. If the permission is required for specific integrations, create a dedicated permission set with limited scope and remove it from general-purpose sets

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Permission Set View All Data fix difficulty: medium #

Remove View All Data from permission sets or reduce the number of users it is assigned to

  1. Go to Setup > Users > Permission Sets
  2. Click the name of the flagged permission set
  3. Click "System Permissions" in the left sidebar
  4. Click "Edit" and uncheck "View All Data"
  5. If broad visibility is required for a subset of users, create a purpose-specific permission set with a limited assignee list
  6. Save and verify assignees no longer bypass sharing rules

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Permission Set Manage Users Wide fix difficulty: medium #

Reduce the number of users assigned Manage Users via permission sets to 5 or fewer

  1. Go to Setup > Users > Permission Sets
  2. Click the name of the flagged permission set
  3. Click "Manage Assignments" to view all current assignees
  4. Remove assignees for whom user management is not a core job function
  5. If user administration must be broader, consider using Delegated Administration with scoped permissions instead
  6. Save and re-scan to confirm the assignee count is within the recommended threshold

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Permission Set API Access fix difficulty: easy #

Remove API access from permission sets that do not require programmatic Salesforce access

  1. Go to Setup > Users > Permission Sets
  2. Click the flagged permission set
  3. Click "System Permissions"
  4. Uncheck "API Enabled" if API access is not required
  5. Save changes and verify affected users still have necessary access

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Login From Multiple IPs fix difficulty: medium #

Investigate users logging in from many unique IP addresses to detect credential sharing or compromise

  1. Go to Setup > Security > Login History
  2. Filter by the flagged user to review login IP addresses
  3. Determine if the IPs correspond to legitimate locations
  4. If suspicious, reset the user's password and enable login IP restrictions
  5. Consider enabling Salesforce Shield Event Monitoring for ongoing detection

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Active User Without Role fix difficulty: easy #

Assign a role to active users for proper record visibility and sharing rule enforcement

  1. Go to Setup > Users > Users
  2. Find the flagged user and click "Edit"
  3. Select an appropriate role from the "Role" dropdown
  4. Save changes
  5. Verify the user's record access is appropriate under the new role

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Weak Password Complexity fix difficulty: easy #

Increase password complexity requirements to enforce mixed character types

  1. Go to Setup > Security > Password Policies
  2. Locate the "Password complexity requirement" setting
  3. Select "Must mix alpha, numeric, and special characters" or higher
  4. Click "Save" to apply the new complexity requirement
  5. Notify users about updated password requirements

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Permission Set Manage Malicious Files fix difficulty: easy #

Restrict the Manage Malicious Files permission to a small number of assignees

  1. Log in to Salesforce Setup
  2. Navigate to Permission Sets
  3. Locate the flagged permission set
  4. Remove the Manage Malicious Files permission or reduce assignees
  5. Review and confirm changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Profile Manage Malicious Files fix difficulty: easy #

Remove the Manage Malicious Files permission from profiles that do not need it

  1. Log in to Salesforce Setup
  2. Navigate to Profiles
  3. Select the flagged profile
  4. Under System Permissions, uncheck "Manage Malicious Files"
  5. Save the profile

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Profile Data Export fix difficulty: medium #

Remove the Data Export permission from profiles that do not require mass export of org data

  1. Go to Setup > Users > Profiles (Enhanced Profiles UI)
  2. Click the name of the flagged profile
  3. Navigate to "System Permissions" and click "Edit"
  4. Uncheck "Weekly Data Export" / "Data Export" to remove the permission
  5. Confirm with the data owner that scheduled or on-demand mass exports are not required for this profile
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Permission Set Data Export fix difficulty: medium #

Remove the Data Export permission from permission sets or restrict which users it is assigned to

  1. Go to Setup > Users > Permission Sets
  2. Click the name of the flagged permission set
  3. Click "System Permissions" in the left sidebar
  4. Click "Edit" and uncheck "Weekly Data Export" / "Data Export"
  5. If mass export is required for a specific integration, create a dedicated permission set with a limited assignee list
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Profile Bulk API Hard Delete fix difficulty: medium #

Remove the Bulk API Hard Delete permission from profiles to prevent permanent bulk record deletion that bypasses the Recycle Bin

  1. Go to Setup > Users > Profiles (Enhanced Profiles UI)
  2. Click the name of the flagged profile
  3. Navigate to "System Permissions" and click "Edit"
  4. Uncheck "Bulk API Hard Delete" to remove the permission
  5. Confirm no users in this profile require permanent bulk deletion that bypasses the Recycle Bin
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Permission Set Bulk API Hard Delete fix difficulty: medium #

Remove the Bulk API Hard Delete permission from permission sets or restrict which users it is assigned to

  1. Go to Setup > Users > Permission Sets
  2. Click the name of the flagged permission set
  3. Click "System Permissions" in the left sidebar
  4. Click "Edit" and uncheck "Bulk API Hard Delete"
  5. If permanent bulk deletion is required for a specific integration, create a dedicated permission set with a limited assignee list
  6. Save and re-scan to confirm the finding is resolved

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Salesforce checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial