Loading
Government Cloud
Classify and Protect Data in Government Cloud

You are here:

  1. Salesforce Help
  2. Docs
  3. Government Cloud

Classify and Protect Data in Government Cloud

Configure data classification settings, enable field change tracking, and implement advanced data protections in your Salesforce Government Cloud Plus org. These procedures walk you through tagging fields by sensitivity and compliance category, enabling Field History Tracking, and reviewing Salesforce Shield.

Required Editions

Available in: Enterprise and Unlimited Editions
Version 1.0
Last Updated May 2026
User Permissions Needed
To configure data classification settings: Customize Application
To enable field history tracking: Customize Application
To manage data classification metadata: Manage Users
  1. Configure Data Classification Settings
    1. Set org-wide sensitivity defaults
      1. From Setup, in the Quick Find box, enter Data Classification Settings, then select Data Classification Settings.
      2. Select or deselect Use default data sensitivity level. When enabled, fields with preset sensitivity values (such as the email field, which defaults to Confidential) display those values in the UI.
    2. Assign classification values to individual fields
      1. From Setup, select Object Manager, then select the object you want to configure.
      2. Select Fields & Relationships from the sidebar, then select the field you want to classify and click Edit.
      3. From the dropdown lists, select the appropriate values for each metadata field:
        • Data Sensitivity Level: Public, Internal, Confidential, or Restricted
        • Compliance Categorization: PII, PHI, HIPAA, GDPR, PCI, or other applicable framework
        • Data Owner: The user or group responsible for governing this data set
      4. Click Save.
      5. Repeat for each field that contains sensitive or regulated data across all relevant objects.
  2. Enable Field History Tracking
    To track changes to specific fields on a Salesforce object:
    1. From Setup, in the Quick Find box, enter Field History Tracking, then select Field History Tracking.
    2. Click View for the object whose fields you want to track.
    3. Select Enable [Object Name] History.
    4. Choose the fields to track and what to capture:
      • To capture both old and new values on change: select those fields under Track old and new values.
      • To capture only that a change occurred (for multi-select picklists and large text fields): select those fields under Track changes only.
    5. Click Save.
      Salesforce begins tracking history from the moment you save. Historical data prior to enabling tracking is not retroactively captured.
    Note
    Note Field History Tracking is limited to 20 fields per object. For tracking up to 60 fields per object with long-term, customer-controlled retention, contact your Salesforce Account Executive about Salesforce Shield's Field Audit Trail.
  3. Enable Salesforce Shield
    Salesforce Shield is a licensed add-on that provides three advanced data governance capabilities:
    Capability What It Does
    Shield Platform Encryption Encrypts data at rest (fields, files) using AES 256-bit encryption while preserving search and validation functionality. Customers manage their own encryption key material.
    Field Audit Trail Extends field tracking to 60 fields per object with customer-controlled, indefinite data retention—enabling long-term forensic auditability.
    Event Monitoring Provides visibility into who accesses data, from where, and how—and enables policies to proactively protect data.
    1. Contact your Salesforce Account Executive to confirm Shield licensing for your Government Cloud Plus org.
    2. Once licensed, follow the Shield setup documentation in Salesforce Help to configure Platform Encryption, Field Audit Trail, and Event Monitoring for your org.
    Note
    Note Test Shield Platform Encryption in a sandbox before deploying to production. Encryption can affect search results, workflow rules, validation rules, and reports depending on which field types are encrypted.
  4. Understand Data Masking for AI and Sandbox Environments

    Einstein Trust Layer — Masking for Generative AI

    When Prompt Builder sends data to a Large Language Model (LLM), the Einstein Trust Layer automatically applies two types of masking before the prompt leaves Salesforce:

    • Field-Based Masking: Identifies sensitive fields using Data Classification metadata and masks their values before transmission. Accurate field classification is required for this to function correctly.
    • Pattern-Based Masking: Uses machine learning to detect and mask data in specific formats—such as Social Security Numbers—even if the field is not explicitly tagged.

    No additional configuration is required to activate Einstein Trust Layer masking once Data Classification metadata is in place.

 
Laden
Salesforce Help | Article