You are here:
Setup Audit Trail Control
Tracks administrative and configuration changes in Salesforce Setup to provide an auditable history of who changed what and when, supporting security monitoring and forensic investigations.
Control Name
Setup Audit Trail
Control Overview
Tracks administrative and configuration changes in Salesforce Setup to provide an auditable history of who changed what and when, supporting security monitoring and forensic investigations.
Description
Setup Audit Trail logs key admin activities, such as profile and permission changes, new app or integration configuration, security setting updates, and metadata changes. Because Salesforce only retains a limited history natively, companies must regularly export and store these logs externally to meet longer-term audit and compliance requirements.
Recommended Configuration
Export Audit Trail every 6 Months (as not retained in Salesforce after 6 months). Setup>View Setup Audit Trail>Download.
Security Impact
Regularly exporting and retaining Setup Audit Trail logs preserves visibility into historical admin actions, helps detect unauthorized or risky changes, and supports root-cause analysis after security incidents.
Business Impact
Long-term audit trail retention supports internal audits, regulatory examinations, and change-management reviews, reducing the risk of compliance findings and improving governance over Salesforce configuration.
Security Risk If Not Configured
Inadequate retention of administrative Audit Trail logs.
Threat Scenarios
Increased risk of failure to prevent detection of unauthorized configuration changes and administrator abuse.
Estimated CVSS Score Range
High (7.0–8.9).
Risk Impact Considerations
Impact increases with the number of admins and complexity of org configuration. Industries with strict audit and retention requirements (for example, financial services, healthcare, public sector) face higher regulatory and operational risk if logs are not retained.
Higher Risk When
Many users have elevated privileges, frequent configuration changes occur, multiple integrations rely on security settings, or the company must demonstrate several years of configuration history to regulators or customers.
Low Risk When
A small number of tightly controlled admins manage a relatively simple org, configuration changes are infrequent and well-documented in a separate change-management system, and regulatory audit requirements are minimal.
Business and Integration Considerations
Exported logs should be stored in an enterprise log management, SIEM, or archival system and, where possible, correlated with other security and application logs.
Security Health Review Guidance
Strongly recommended.
Who Is Impacted
Salesforce system administrators, security and compliance teams, internal and external auditors, and change-management or governance committees that rely on configuration history.
