You are here:
Field History Tracking Retention Control
Extends standard 18-month Field History Tracking retention through external archiving or Field Audit Trail upgrade, to support long-term auditability of critical data changes for compliance requirements.
Control Name
Field History Tracking Retention
Control Overview
Extends standard 18-month Field History Tracking retention through external archiving or Field Audit Trail upgrade, to support long-term auditability of critical data changes for compliance requirements.
Description
Native Field History Tracking automatically purges data after 18 months; companies must implement export-to-S3/SIEM processes or purchase Field Audit Trail add-on for 10-year retention on up to 60 fields across key objects.
Recommended Configuration
Define Archival Retention policy in Field History Tracking - at least 1 year; schedule weekly CSV exports via Data Loader or implement Field Audit Trail for automatic 10-year Big Object storage.
Security Impact
Preserves complete data modification history for forensic analysis, regulatory audits, and insider threat investigations beyond Salesforce's native 18-month limitation.
Business Impact
Meets long-term retention mandates (HIPAA 6yr, SOX 7yr, GDPR 2yr+), eliminates manual archiving processes, and provides defensible audit evidence without third-party tools.
Security Risk If Not Configured
Insufficient retention for field history tracking data creates gaps in audit trails after 18 months, violating compliance requirements and hindering historical incident investigations.
Threat Scenarios
Auditors discover missing field history beyond 18 months during compliance reviews; historical insider tampering or data manipulation cannot be reconstructed; regulators issue findings for inadequate retention controls.
Estimated CVSS Score Range
High (7.0–8.9).
Risk Impact Considerations
Retention needs vary by regulation (1–10 years); Field Audit Trail storage costs scale with field count and change frequency; exports require secure external storage.
Higher Risk When
Regulated industries (financial, healthcare), high-value transactional data, frequent field changes on PII-containing objects, or external audit requirements exceeding 18 months.
Low Risk When
Non-regulated environments, read-only data, infrequent updates, or comprehensive Event Monitoring providing alternative audit trail coverage.
Business and Integration Considerations
Field Audit Trail preferred over manual exports for automation and tamper-proof storage; test restore processes annually.
Security Health Review Guidance
Strongly recommended.
Who Is Impacted
Compliance managers, internal/external auditors, legal teams managing retention schedules, Salesforce admins implementing archival processes.
