Security Health Review replaces the PDF-only experience with an interactive report viewer built directly into Setup. You get a continuous, actionable view of your org's security posture, complete with findings management, remediation tracking, and disposition workflows. A full audit trail records every report, disposition, and remediation action for governance and compliance.
Where: This change applies to Lightning Experience in Enterprise and Unlimited editions. Access is limited to Signature Success customers. The Health Assessments Agent requires the Salesforce Foundations add-on. Contact your Salesforce account executive to inquire about access.
Who: Users with the Customize Application or Modify All Data permission have access by default. To grant access to additional users, assign the View Health Assessments or Manage Health Assessments permission.
Why: This table describes the new capabilities.
| New Capability | What It Does |
|---|---|
| Interactive report viewer | Reports render in Setup with an Executive Summary, severity tiles, a remediation progress bar, and a full findings table. To switch between previous reports, use the Viewing dropdown. |
| PDF and CSV export | Download reports as a PDF for executive stakeholders, or as a CSV for data analysis outside Salesforce. |
| Salesforce Mandated Critical Controls | Mandatory controls appear at the top of the report, separate from severity tiers. These cannot be dispositioned. |
| Findings tab | Filter and search active findings by severity, security domain, and remediation status. Export to CSV. |
| Remediation tracking | Record progress on individual findings (Open, In Progress, Blocked) without affecting active severity counts. |
| Disposition | To formally exclude findings, use Accept Risk, Mitigated by Alternative Control, or Not Applicable. Dispositioned findings move to the Customized Controls tab. |
| Customized Controls tab | Lists all dispositioned findings with disposition type, classifying user, and expiration date. |
| Compliant Controls tab | Lists all controls that passed the Ideal Salesforce Org Security Hardening Benchmark. |
| User Activity Log | Full audit trail of report generation, disposition, and remediation actions, with timestamp, user, and finding ID. |