The CISO's Guide to Salesforce Shield
A practical framework for CISOs and security architects to implement Salesforce Shield. Go beyond the marketing to master Platform Encryption, Event Monitoring, and Field Audit Trail for true enterprise-grade security and compliance.
Download the Shield Implementation Checklist
A CISO-approved checklist for planning your Salesforce Shield deployment, from data classification and key management to threat detection playbooks.
Download Free ChecklistFor any CISO, the move to a cloud platform like Salesforce introduces a new set of risks. While Salesforce provides a robust baseline of security, for regulated industries handling sensitive PII, PHI, or financial data, it's not enough. You need a higher level of control over data encryption, user activity monitoring, and compliance auditing.
Salesforce Shield is a set of three integrated services—Platform Encryption, Event Monitoring, and Field Audit Trail—that provides the tools to meet these stringent requirements. However, a successful implementation requires more than just flipping a switch. It demands a strategic approach to key management, threat modeling, and performance optimization. This guide provides that strategic framework.
The Three Pillars of Salesforce Shield
Shield isn't one product, but a suite of three distinct services that work together to create a comprehensive security and compliance layer on top of your Salesforce org.
1. Platform Encryption
This is the core of Shield. It allows you to encrypt sensitive data at rest in the Salesforce database, not just in transit. Crucially, it provides options for key management, including Bring Your Own Key (BYOK), giving you ultimate control over your data's security.
- What it protects: Standard & custom object fields, files, attachments, and more.
- Key differentiator: Control over the key lifecycle, enabling you to meet specific compliance mandates.
2. Event Monitoring
This gives you the "who, what, when, and where" of all activity in your Salesforce org. It provides detailed performance, security, and usage data on all your applications, allowing you to build a sophisticated threat detection and response program.
- What it tracks: Logins, report exports, API calls, Apex executions, and over 50 other event types.
- Key differentiator: The ability to stream these events in near real-time to your SIEM (e.g., Splunk, QRadar) for correlation and analysis.
3. Field Audit Trail
Standard Salesforce field history is limited to 20 fields per object and 18 months of retention. Field Audit Trail expands this dramatically, allowing you to track up to 60 fields per object with a retention period of up to 10 years, which is essential for long-term compliance and forensic investigations.
- What it tracks: Historical changes to field values, including the before and after state.
- Key differentiator: Long-term, policy-based data retention that satisfies stringent industry regulations.
The Shield Implementation Framework: A CISO's Action Plan
Phase 1: Threat Modeling & Encryption Strategy
Before encrypting anything, you must define what you are protecting against and what the performance trade-offs are.
Encrypting fields can impact performance, especially in reports, list views, and SOQL queries that use those fields as filters. Encrypt only what is required by your data classification policy. A "encrypt everything" approach will cripple your org.
- Data Classification: Create a formal policy that defines what data is considered sensitive (e.g., PII, PHI) and requires encryption.
- Key Management Strategy: Decide between Salesforce-generated keys or BYOK. For most regulated industries, BYOK is the standard. Plan your key rotation ceremony and disaster recovery process.
- Pilot Encryption: Test encryption on a limited set of fields in a full sandbox to measure performance impact before deploying to production.
Phase 2: Building Your Threat Detection Playbook with Event Monitoring
Event Monitoring generates millions of data points. Without a clear plan, this data is just noise. Define specific threat scenarios you want to detect.
Trigger: User runs a Report with > 5,000 rows.
Event Log: ReportExport Event
Action: Create a Transaction Security Policy that:
1. Notifies the user's manager and the security team.
2. Blocks the export if the user is on an untrusted IP range.
3. Requires two-factor authentication for the user's next login.
Start with 3-5 high-priority use cases, such as large data exports, logins from suspicious locations, or privilege escalation by administrators.
Phase 3: Deploying a Compliant Audit Strategy
Work with your compliance team to define your data retention policy. Use Field Audit Trail to meet these requirements without creating a massive, unmanageable data store.
- Define Audit Policies: Set a retention policy (e.g., `archive after 5 years, delete after 10 years`) for key objects like Account, Contact, and Case.
- Automate Archiving: Field history data is archived to a BigObject. Plan how your audit team will access and query this archived data.
- Monitor Adoption: Ensure that as new critical fields are created, they are added to the Field Audit Trail policy.
Ready to Fortify Your Salesforce Org?
Schedule a Salesforce Security Posture Assessment. We'll help you build a business case for Shield and design an implementation roadmap that meets your unique compliance and security requirements.
Book a Security Assessment →