You are here:
Security Settings and Compliance Monitoring in Government Cloud
Salesforce Government Cloud Plus provides a set of FedRAMP-recommended password policies, session security settings, and compliance monitoring tools that help agencies harden their org configuration and maintain that posture over time. Security Health Check offers interactive scoring against agency baselines, while the Metadata API enables machine-readable exports, drift detection, and programmatic remediation at enterprise scale.
Required Editions
| Available in: Enterprise and Unlimited Editions |
| Version | 1.0 |
| Last Updated | May 2026 |
A securely configured Salesforce Government Cloud Plus org requires both initial hardening and continuous monitoring. Initial hardening involves applying recommended settings for two core areas:
- Password Policies: Control password strength, expiration, history, complexity, lockout behavior, and reset workflows to ensure authenticators meet government requirements.
- Session Security Settings: Control how sessions are established, timed out, locked, and protected against attacks such as clickjacking, cross-site request forgery (CSRF), and session hijacking.
Configuring these settings is a point-in-time action. Maintaining compliance requires tools that can continuously compare your org's configuration against a known-good baseline, detect unauthorized changes, and enforce standards across all environments.
Security Health Check provides an interactive dashboard in Setup that scores your org against the Salesforce Baseline Standard or a custom agency baseline. Up to five custom baselines can be uploaded, allowing agencies to score against regulation-specific or mission-specific standards. Health Check covers a wide array of configuration controls and allows administrators to remediate failing settings directly from the dashboard.
Metadata API extends compliance monitoring to a programmatic, enterprise-grade capability. Security configurations—Password Policies, Session Settings, Network Access, and Permission Sets—can be extracted as machine-readable XML using the retrieve() call. These files can be stored in a version control system (such as Git) to create an immutable configuration history. This enables:
- Drift Detection: Comparing a current export against a baseline immediately surfaces unauthorized changes.
- Change Tracking: Version control provides a granular audit trail showing exactly what changed, when, and by whom.
- Peer Review: Security changes can be managed through pull requests, requiring oversight before deployment.
- Programmatic Remediation: The deploy() call allows administrators to push corrected configurations back to the org—enabling mass remediation across Developer, Sandbox, and Production environments simultaneously.
Metadata API to Automate and Export Org Security
While the Security Health Check provides an excellent interactive dashboard for identifying vulnerabilities, enterprise governance requires a scalable, programmatic approach to security management. To satisfy compliance standards regarding machine-readable exports and API-based configuration management, security architects can leverage the Metadata API. This API enables organizations to treat security configurations not just as administrative tasks, but as a manageable data asset—ensuring consistency, auditability, and rapid remediation across all environments.
Machine-Readable Exports for Compliance
The Metadata API utilizes the retrieve() call. This function allows administrators to extract configuration data from an organization and save it as XML files. Unlike UI screenshots or manual checklists, these XML exports provide a precise, readable definition of your organization's security posture, including Password Policies, Session Settings, and Network Access controls. By automating these retrievals, organizations can archive the exact state of their security controls at any point in time, satisfying strict audit retention policies.
Key Security Metadata Types
To effectively manage security via the API, architects should focus on specific metadata types that map to critical controls:
- SecuritySettings: This is a primary container for org-wide security controls, including Session Settings, Password Policies, and Network Access settings.
- PermissionSet: This type defines the specific collection of permissions and access settings assigned to users, allowing for granular control over what users can do within the org.
- NetworkAccess: Often managed within SecuritySettings or Profile IP ranges, this controls the IP addresses from which users can log in.
- AiSettings: As organizations adopt Agentforce, types such as EinsteinAISettings and AgentPlatformSettings become critical for governing how AI agents interact with data and users.
- Configure Security Settings and Monitor Compliance in Government Cloud
Apply recommended password policies and session security settings to your Salesforce Government Cloud Plus org, then use Security Health Check and the Metadata API to validate your configuration, detect drift, and remediate deviations at scale.
