---
schema_version: "1"
id: dbd88b0cf68549c6df5da1454450675dcf0c6ce93686e76bf12f3647af925479
title: Security Health Review 2.0
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_health_review_shr2.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_health_review_shr2.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 83eed43d8247c9c4c45913b67d880c66e8c40746429f47140024fa2a1679210a
description: Security Health Review replaces the PDF-only experience with an interactive report viewer built directly into Setup. You get a continuous, actionable view of your org's security posture, complete with findings management, remediation tracking, and disposition workflows. A full audit trail records every report, disposition, and remediation action for governance and compliance.
products:
  - Cross Cloud
release: "264"
---
# Security Health Review 2.0

Security Health Review replaces the PDF-only experience with an interactive report viewer built directly into Setup. You get a continuous, actionable view of your org's security posture, complete with findings management, remediation tracking, and disposition workflows. A full audit trail records every report, disposition, and remediation action for governance and compliance.

**Where:** This change applies to Lightning Experience in Enterprise and Unlimited editions. Access is limited to Signature Success customers. The Health Assessments Agent requires the Salesforce Foundations add-on. Contact your Salesforce account executive to inquire about access.

**Who:** Users with the Customize Application or Modify All Data permission have access by default. To grant access to additional users, assign the View Health Assessments or Manage Health Assessments permission.

**Why:** This table describes the new capabilities.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-264-0-0-production-enus/550ba85b-db1a-4608-9cd4-9a65ec96e1fa/images/icon_tip.png)

Tip Some features, including the new Mandatory signal category, only take effect in new reports. Generate a new report to use the latest features.

 
| New Capability | What It Does |
| --- | --- |
| Interactive report viewer | Reports render in Setup with an Executive Summary, severity tiles, a remediation progress bar, and a full findings table. To switch between previous reports, use the Viewing dropdown. |
| PDF and CSV export | Download reports as a PDF for executive stakeholders, or as a CSV for data analysis outside Salesforce. |
| Salesforce Mandated Critical Controls | Mandatory controls appear at the top of the report, separate from severity tiers. These cannot be dispositioned. |
| Findings tab | Filter and search active findings by severity, security domain, and remediation status. Export to CSV. |
| Remediation tracking | Record progress on individual findings (Open, In Progress, Blocked) without affecting active severity counts. |
| Disposition | To formally exclude findings, use Accept Risk, Mitigated by Alternative Control, or Not Applicable. Dispositioned findings move to the Customized Controls tab. |
| Customized Controls tab | Lists all dispositioned findings with disposition type, classifying user, and expiration date. |
| Compliant Controls tab | Lists all controls that passed the Ideal Salesforce Org Security Hardening Benchmark. |
| User Activity Log | Full audit trail of report generation, disposition, and remediation actions, with timestamp, user, and finding ID. |