Security Health Check

Why Security Health Check Matters
As a Salesforce Advanced Administrator, you are responsible not just for configuring security settings, but for knowing whether those settings are actually adequate. Security is spread across dozens of pages in Setup: Password Policies, Session Settings, Login Access Policies, Remote Site Settings, Certificate and Key Management, and more. Without a central view, gaps go unnoticed until an audit or a breach exposes them. Security Health Check solves this by giving you a single dashboard that scores your org against a security baseline and tells you exactly which settings are weak and how to fix them. On the exam, this topic falls under the Auditing and Monitoring domain, and questions test whether you understand what the tool does, how the score is calculated, and how custom baselines work.

What Security Health Check Is
Security Health Check is a free, standard Setup tool (Setup → Quick Find → Health Check) that compares your org's current security settings against a baseline and produces a percentage score from 0 to 100. The default baseline is the Salesforce Baseline Standard, which represents Salesforce's recommended security configuration. The higher your score, the closer your org is to meeting the baseline.

Key facts to remember:
• It is available in Professional, Enterprise, Performance, Unlimited, and Developer editions.
• It evaluates org-wide security settings only. It does not evaluate data security such as object permissions, field-level security, sharing rules, or record access. It also does not audit user behavior or login history.
• It requires the View Health Check permission to see it and Manage Health Check to edit settings or import custom baselines (both included in the System Administrator profile).

How the Score Works
Each setting Health Check evaluates is assigned to a risk category:
• High-Risk Security Settings
• Medium-Risk Security Settings
• Low-Risk Security Settings
• Informational Security Settings

For each setting, Health Check shows your current value, the baseline (Standard) value, and a status of Compliant, Warning, or Critical. High-risk settings carry the most weight in the score; informational settings carry little or none. Fixing a critical high-risk item raises your score far more than fixing a low-risk warning. Your overall score is also labeled with a grade band, typically described as: 90–100% Excellent, 80–89% Very Good, 70–79% Good, 55–69% Poor, and below 55% Very Poor.

Examples of Settings Evaluated
Password Policies (minimum length, complexity, expiration, lockout), Session Settings (timeout, lock sessions to IP, HttpOnly, clickjack protection, CSRF protection, Require HTTPS), Login Access Policies, Remote Site Settings, Certificate and Key Management (expired certificates), Content Security Policy settings, and Trusted IP Ranges. If you can recognize that a setting lives on one of these pages, you can usually predict it appears in Health Check.

Fix Risks: Remediating in Bulk
The Fix Risks button lets you remediate multiple non-compliant settings at once from the Health Check page without navigating to each Setup page individually. You can preview the changes, select which ones to apply, and confirm. Some settings cannot be changed through Fix Risks (for example, those that require deleting items such as expired certificates) and must be fixed on their own Setup page. Caution: Fix Risks changes live org settings immediately, so Salesforce recommends testing in a sandbox first and warning users, because tightening session or password settings can affect active users and integrations.

Custom Baselines
Many organizations have their own security standards that differ from Salesforce's. Health Check supports custom baselines, which let you define your own target values and risk categories for each setting. Important details:
• A custom baseline is created by exporting the current baseline as an XML file, editing it, and importing it back.
• The XML file must be under 5 MB.
• You can import up to five custom baselines per org.
• You can switch between the Salesforce Baseline Standard and any custom baseline from a dropdown at the top of the Health Check page, and your score recalculates against the chosen baseline.
• In the custom baseline you can change the standard value for a setting and move a setting to a different risk category, but you cannot add settings that Health Check does not already evaluate.

Security Health Check and the Security Center / API
Health Check data is exposed through the SecurityHealthCheck and SecurityHealthCheckRisks objects in the Tooling API, which allows orgs to extract scores programmatically for reporting or for monitoring many orgs at once. Health Check data also feeds into Security Center (a paid add-on) for multi-org visibility. For the exam, know that Health Check itself is per-org and that multi-org aggregation requires Security Center or the API.

Health Check vs. Other Auditing Tools
The exam frequently tests whether you can choose the right tool:
• Security Health Check – evaluates the configuration of org-wide security settings against a baseline. Answers "How secure are my settings compared to a standard?"
• Setup Audit Trail – records who changed what in Setup over the last 180 days. Answers "Who changed the password policy last week?"
• Login History – records login attempts, status, IP, and browser. Answers "Who logged in from an unusual location?"
• Field History Tracking / Field Audit Trail – tracks changes to record data. Answers "Who changed this Opportunity's Amount?"
• Event Monitoring (Shield) – detailed user activity logs such as report exports and API calls.
• Salesforce Optimizer – evaluates overall org health including unused fields, profiles, and limits; it is not a security scoring tool.

Exam Tips: Answering Questions on Security Health Check

1. Look for the words "baseline," "score," or "compare to recommended settings." If a scenario describes wanting to measure how the org's security settings compare to Salesforce recommendations or to an industry standard, the answer is Security Health Check.

2. Know what it does NOT do. If the question asks about record access, sharing, field-level security, or who performed an action, Health Check is a distractor. Those point to sharing settings, FLS, Setup Audit Trail, or Login History instead.

3. Remember the risk categories and their weighting. High-Risk, Medium-Risk, Low-Risk, and Informational. If asked how to raise the score fastest, the correct answer is to remediate High-Risk settings marked Critical.

4. Custom baseline questions test the mechanics. Export the XML, edit it, import it; 5 MB limit; up to 5 custom baselines; you can change standard values and risk categories but not add new settings. A scenario about a company whose compliance team requires a 12-character password minimum while Salesforce's baseline requires 8 is asking about a custom baseline.

5. Fix Risks is the bulk remediation answer. If the question asks for the most efficient way to correct multiple non-compliant settings, choose Fix Risks. If it mentions items that cannot be fixed there (like deleting expired certificates), know those must be handled on their own Setup page.

6. Permissions matter. View Health Check to see it; Manage Health Check to change settings or import baselines. A question about a security analyst who should see the score but not change anything points to View Health Check only.

7. Multi-org or programmatic scenarios. If the company has many orgs and wants a consolidated view, think Security Center or the Tooling API objects (SecurityHealthCheck, SecurityHealthCheckRisks), not the standard Health Check page alone.

8. Best-practice answers win. When choices include testing in a sandbox before applying Fix Risks, communicating changes to users, and reviewing settings that may impact integrations, those are the ones Salesforce considers correct. Avoid answers that imply blindly applying every recommendation in production.

9. Eliminate tool-confusion distractors. Setup Audit Trail, Login History, Optimizer, and Event Monitoring are the most common wrong answers paired with Health Check. Ask yourself: Is the question about configuration strength (Health Check) or about activity and history (the others)?

Summary
Security Health Check is your single-pane view of org security configuration. It scores your org against the Salesforce Baseline Standard or a custom baseline, groups findings by risk category, and lets you remediate in bulk with Fix Risks. For the exam, master the score components, the custom baseline import rules, the required permissions, and above all the distinction between evaluating settings (Health Check) and auditing activity (Audit Trail, Login History, Event Monitoring).