Salesforce
12 February 2026
To protect your data, maintain compliance, and ensure business continuity, here are the key Salesforce security controls every admin should implement now.
MFA is the first line of defense against unauthorised access. Salesforce now requires all users to enable MFA for internal and external users.
Why it matters:
Implementation tip: Enforce MFA via Profiles and Permission Sets, and communicate to users before rolling out.
| Control | Purpose | Best Practice |
|---|---|---|
| Trusted IP Ranges | Limits login access to approved networks | Use for internal users, offices, VPNs |
| Login Hours | Restricts access to working hours | Prevents off-hours access by mistake or attack |
These settings help prevent unauthorised access even if credentials are compromised.
Many Salesforce integrations use OAuth tokens, which can be exploited if left unmonitored.
Checklist:
A well-structured access model is essential. Avoid giving broad access unnecessarily.
Tips:
Salesforce Event Monitoring captures login activity, API calls, and data access events.
Benefits:
Quick tip: Use Shield or native audit logs to automate alerts for anomalies.
Sensitive data should always be encrypted and restricted to authorised users.
Action points:
Salesforce provides built-in Security Health Check to measure your org against best practices.
Pro tip: Schedule monthly reviews and address all critical/high risk points.
Implementing these controls doesn’t have to be overwhelming. A staged approach, starting with MFA, IP restrictions, and connected app audits, will drastically improve your security posture.
Cognition24’s Salesforce-certified experts provide fast, thorough security reviews to ensure your environment is fully protected and compliant.
