7 Salesforce Security Settings Every Small Business Should Check Today

Check seven things in Salesforce Setup: multi-factor authentication, your Security Health Check score, session settings, login IP ranges and hours, password policy, who holds Modify All Data, and connected app policies. Each takes minutes. Privacy law, including New Zealand's Privacy Act 2020, requires "such security safeguards as are reasonable in the circumstances", so this is a legal baseline, not an IT nicety.

Why does this matter for a small business?

Take New Zealand, where SAASKOOL is based, as the worked example. The National Cyber Security Centre (which completed integrating CERT NZ on 23 July 2025) publishes quarterly figures; as at September 2026 the latest, Quarter Two Cyber Security Insights 2026, covers 1 April to 30 June 2026. It "responded to 1,129 incident reports"; "Direct financial loss reported during Q2 was $2.7 million"; "Scams and fraud was the most common incident category this quarter with 348 incidents", followed by "phishing and credential harvesting"; and "Unauthorised access was notably responsible for a reported direct financial loss of $1.3M". National NZD figures, not an SMB breakdown, but phishing and unauthorised access are what these settings defend against.

Information privacy principle 5 of New Zealand's Privacy Act 2020 (as at September 2026) requires personal information to be protected "by such security safeguards as are reasonable in the circumstances to take" against loss and "access, use, modification, or disclosure that is not authorised by the agency". A "notifiable privacy breach" is one "that it is reasonable to believe has caused serious harm to an affected individual or individuals or is likely to do so" (s 112). You must notify the Commissioner "as soon as practicable" (s 114); the Commissioner's stated expectation (16 May 2024, as at September 2026) is "within 72 hours", though that "is a guide only". Failing to notify is an offence with "a fine not exceeding $10,000" (s 118).

1. Is multi-factor authentication on for every user?

Salesforce made MFA contractual "On February 1, 2022" (as at September 2026), auto-enabled it for most existing production orgs in phases "starting with the Spring '23 release and finishing with Spring '24", and now states that "Salesforce enforces MFA requirements in the summer of 2026". The NCSC: "MFA is adopted by organisations to assist in protecting business-critical and external-facing systems from unauthorised access, misuse, or compromise."

What Salesforce expects. "passkeys (built-in authenticators and security keys), Salesforce Authenticator, and third-party authenticator apps such as Google Authenticator". SMS codes are "For external users only".

Where to click. Setup, Quick Find "Identity Verification"; confirm "Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org" is selected. Admins who deselect it get "periodic in-app warnings until MFA is re-enabled". "Salesforce doesn't enable MFA in sandbox environments", and after enforcement the "Waive Multi-Factor Authentication for Exempt Users" permission "no longer automatically exempts users from MFA"; restoring one means "you must contact Salesforce Customer Support".

The common SMB mistake. Assuming SSO or a shared login covers it. Salesforce "won't take action to enable MFA for your SSO implementation", yet "you are contractually required to implement MFA for all users who access Salesforce via SSO".

2. What is your Security Health Check score?

Health Check scores your org against the "Salesforce Baseline Standard" (as at September 2026) and is built into "Professional, Enterprise, Performance, Unlimited, and Developer Editions". Grades run from "90% and above = Excellent" down to "54% and below = Very Poor". A "Fix Risks" button applies the baseline's values "without leaving the Health Check page", with weekly notifications if the score decreases.

Where to click. Quick Find "Health Check". The baseline rows SMBs fail most often:

Setting	Compliant	Warning	Critical
Maximum invalid login attempts	3	5 or 10	No Limit
Lock sessions to the domain in which they were first used	Selected	N/A	Deselected
Enforce login IP ranges on every request	Selected	Deselected	N/A
Administrators Can Log In As Any User	Deselected	Selected	N/A
Enforce password history	3 or more passwords remembered	1 or 2 passwords remembered	No passwords remembered
Minimum password length	8	6 or 7	5 or less
User passwords expire in	90 days or less	180 days	One year or Never expires
Timeout Value	2 hours or less	4, 8, or 12 hours	Deselected
Lockout effective period	30 minutes or greater	Less than 30 minutes	N/A

The common SMB mistake. Clicking Fix Risks on everything at once: a shorter timeout logs people out and IP enforcement can break an integration. Fix High-Risk rows first.

3. Are your session settings doing their job?

Four settings on the Session Settings page (as at September 2026) matter for an SMB:

• Lock sessions to the domain in which they were first used. A High-Risk baseline row, "enabled by default for Salesforce orgs created with the Spring '15 release or later", so check older orgs.
• Lock sessions to the IP address from which they originated. Enterprise and above; Salesforce warns it "can inhibit various applications and mobile devices".
• Force logout on session timeout, with a Timeout Value of "2 hours or less" for the baseline.
• Terminate all of a user's sessions when an admin resets that user's password. This "helps you mitigate security incidents such as stolen passwords and credential stuffing attacks".

Where to click. Quick Find "Session Settings".

The common SMB mistake. The longest timeout available because a manager complained, in an org so old that domain locking was never on.

4. Should you restrict login IP ranges and login hours?

Profile login IP ranges are a hard block: "When you define IP address restrictions for a profile, a login from any other IP address is denied" (as at September 2026), and "As of Winter '26, Salesforce enforces limits for login IP ranges for a specific profile".

Org-level trusted IP ranges (Quick Find "Network Access") are softer: from an untrusted address Salesforce "challenges them to verify their identity" instead of refusing the login. "Enforce login IP ranges on every request" sits on Session Settings, not the profile; without it, "login IP ranges are enforced only when a user logs in".

Login hours are per profile in Enterprise and above: "If users are logged in when their login hours end, they can continue to view their current page, but they can't take any further action".

The honest note. Hard profile ranges lock out staff on home connections, cafés and phones. Most SMBs do better with MFA plus org-level trusted ranges, keeping profile ranges for an integration user or an office-bound finance role.

5. Is your password policy still on the new-org defaults?

Salesforce's new-org defaults (as at September 2026): "at least eight characters, including one alphabetic character and one number", expiry after "90 days", "3 passwords remembered", and a "15 minutes" lockout. The baseline wants complexity that "Must mix alpha, numeric, and special characters", 3 invalid login attempts, and a lockout of "30 minutes or greater".

Where to click. Quick Find "Password Policies".

The common SMB mistake. "Never expires" to stop complaints (critical in the baseline). With MFA off, the password is the only thing between a phishing email and your customer list.

6. Who can see and change everything?

Organisation-wide defaults set "the baseline level of access that users have to records they don't own" (Trailhead, as at September 2026). Private: "Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records." Public Read Only: "All users can view and report on records, but only the owner, and users above that role in the hierarchy, can edit them." Public Read/Write: "All users can view, edit, and report on all records." Quick Find "Sharing Settings".

View All Data and Modify All Data. Holders "can view (or modify) all apps and data, even if the apps and data aren't shared with them"; Trailhead says "use caution when assigning them to any profile other than System Administrator". Deselect "Administrators Can Log In As Any User" too.

Profiles versus permission sets. Salesforce's 6 June 2026 article cancelled the retirement of permissions in profiles but still "recommends adopting a least-privilege model using profiles for baseline settings and permission sets for access control", starting from the "Minimum Access - Salesforce" profile. The Field Access Summary in Object Manager, new in Summer '26, answers "who can see this field"; see our Summer '26 admin post.

The common SMB mistake. Everyone on System Administrator because it was easiest at go-live, and a former employee never deactivated.

7. Which connected apps can reach your data?

Every integration (Xero, Stripe, Wix, a marketing tool) reaches Salesforce through a connected app, and each has OAuth policies (as at September 2026).

What Salesforce expects. Permitted Users defaults to "All users may self-authorize"; "Admin approved users are pre-authorized" limits the app to an assigned profile or permission set. IP Relaxation defaults to "Enforce IP restrictions", applying "the IP ranges assigned to a user profile". "Connected apps creation is restricted as of Spring '26"; existing apps keep working, but Salesforce recommends "external client apps instead" for new builds.

Where to click. Quick Find "Manage Connected Apps"; "Connected Apps OAuth Usage" shows what users have already authorised.

The common SMB mistake. The Xero or Stripe sync still runs under the owner's login, Modify All Data included. Give each integration its own least-privilege user; our Xero guide and Stripe guide cover what each needs.

How do you know what changed?

Setup Audit Trail (as at September 2026) shows "the 20 most recent setup changes"; the full history is downloadable "for the past 180 days", and "After 180 days, setup entity records are deleted". Login History holds "up to 20,000 records of user logins for the past 6 months". Export both monthly; they are what the 72-hour call above will demand. Salesforce's status and security page is trust.salesforce.com.

Where does SAASKOOL fit?

A competent in-house admin needs only this post and an afternoon. Otherwise the free Salesforce health check includes a security review, with a written report you keep. For ongoing ownership, managed services start from NZ$1,000/month and a fractional admin from NZ$99/hr + GST (pricing); see when to hire a fractional admin.

Frequently Asked Questions

Is MFA mandatory for Salesforce? Yes. It has been a contractual requirement since 1 February 2022 for all internal users, including single sign-on users, and Salesforce states that it enforces MFA in the summer of 2026.

What is a good Salesforce Security Health Check score? Salesforce grades 90% and above as Excellent, 80% to 89% as Very Good, 70% to 79% as Good, 55% to 69% as Poor and 54% and below as Very Poor. Aim for Excellent, but fix the High-Risk rows first whatever the number.

Does New Zealand's Privacy Act 2020 require specific Salesforce security settings? No. Privacy principle 5 requires reasonable safeguards and names no product or setting, but vendor-provided controls left switched off are hard to defend after a breach, and failing to notify a notifiable breach carries a fine of up to $10,000.

Who should have Modify All Data? As few people as possible; in most SMBs, one or two named administrators. It grants access to all data even where it is not shared, and Trailhead advises caution assigning it to any profile other than System Administrator.

How long does Salesforce keep the Setup Audit Trail? The page shows the 20 most recent changes, and the full history can be downloaded for the past 180 days, after which records are deleted, so export it monthly. Login History covers up to 20,000 logins for the past six months.

---

The free health check will tell you honestly where these seven settings stand. If nobody owns Salesforce security after that, managed services from NZ$1,000/month puts a name against it.