Salesforce / Health Cloud Security Assessment
Salesforce / Health Cloud security assessment for clearer access priorities
Understand where Salesforce permissions, sharing and integrations need attention before a rollout or expanded sensitive-data use. A scoped configuration review connects findings to risk priorities and practical improvement recommendations.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Make access decisions before expanding platform use
A rollout or expanded sensitive-data use raises access questions. Existing teams may be concerned that too many people can see sensitive information. Salesforce owners need a clear basis for discussing configuration changes with security and compliance leaders.
This assessment supports that decision. It examines the agreed environment so your team can distinguish necessary access from permissions or sharing that deserve attention. Healthcare IT teams using Health Cloud can focus the review on their actual data and workflows. Findings provide a basis for deciding which configuration improvements to prioritize.
Define the orgs, data and access paths in scope
The review covers scoped Salesforce permissions, sharing, connected applications, integrations and security configuration. Salesforce controls access at object, field and record levels. Reviewing these layers together helps explain how access assignments relate to the visibility your business intends.
Coverage starts with the Salesforce orgs and products you use. Your team identifies relevant user groups, sensitive data and integration relationships. Health Cloud is included where it is part of the agreed environment; its name alone does not establish which controls are present or how they are configured.
The scope identifies workflow and integration boundaries. Reviewing Salesforce-side integration configuration does not automatically extend the assessment into connected applications.
Compare configuration evidence with intended access
The intended method is a specialist configuration review. An administrator walkthrough and agreed configuration evidence help establish how permissions and sharing are assigned. Discussions with platform and data owners clarify which users need access for their work.
Relevant evidence may include permission assignments, sharing settings, connected-application details and integration documentation. The review compares that evidence with stated business needs. For example, a user group may have access to sensitive fields that its documented workflow does not require. Any conclusion depends on the configuration and context examined.
The review records evidence gaps. Agree access and sensitive-material handling before inspection. Vulnerability scanning and attack simulation require separate scope.
Use findings to set improvement priorities
The catalog identifies three typical outputs, with their content agreed during scoping:
Permission/configuration findings. Document the access or configuration concerns identified in the reviewed environment. Platform owners use these findings to understand the affected settings and the evidence behind each concern.
Risk priorities. Put findings in an order that reflects the data and workflows involved. Security and compliance leaders use these priorities to discuss which concerns warrant earlier attention.
Improvement recommendations. Describe practical configuration or access-management changes for the responsible owners to consider. Teams use these recommendations to plan work and evaluate dependencies before making changes.
The outputs reflect agreed coverage and available evidence. They do not imply examination of every permission assignment or integration.
Prepare the people and evidence for a focused review
Scoping establishes the review objective and the orgs, products, users, data and integrations involved. The depth of permission analysis and the complexity of sharing arrangements affect effort. Evidence availability and coordination with integration owners also influence cost and timing.
Identify an administrator who can explain configuration choices and data owners who can clarify sensitive-data use. Existing access documentation and an integration inventory help focus the review.
Agree the evidence needed, authorized access and any production constraints. Specialist platform expertise and the proposed scope must be confirmed before engagement commitments. Your organization retains control over access approval and any subsequent configuration changes.
Keep platform review and broader assurance distinct
This is a scoped configuration assessment. A full application penetration test requires a separate testing objective, authorization and scope. Application code and connected systems should not be assumed tested because their configuration relationships appear in the review.
The assessment does not guarantee HIPAA compliance. Healthcare organizations needing an organization-wide electronic protected health information risk analysis should define that broader requirement separately. Salesforce findings can inform those discussions, but a platform review alone does not establish complete coverage.
Recommendations support planning. Implementing changes, retesting and continuous monitoring require separate agreement; they are not included by default in these assessment outputs.
Salesforce security assessment questions
Who is this assessment intended for?
Salesforce owners, healthcare IT teams, CISOs and compliance leads evaluating a rollout, sensitive-data use or excessive visibility. It is useful when those teams need configuration findings to support access and improvement decisions.
Can the scope include Health Cloud and integrations?
Yes, where they are part of the agreed environment. Scoping identifies the products, data and integration boundaries to review. It also confirms relevant specialist expertise rather than assuming coverage of every connected system.
What evidence does the review need?
Agreed configuration evidence and explanations from administrators and data owners. Permission assignments, sharing settings and integration documentation may be relevant. The required detail depends on the access questions and workflows selected.
What determines cost and timing?
The number of orgs and products, user coverage, data complexity and integrations influence effort. Review depth, evidence readiness and authorized access arrangements also matter. Commercial terms follow confirmation of the proposed scope.
How does this differ from a broader SaaS security assessment?
This offer focuses on Salesforce, including Health Cloud where relevant. A broader SaaS configuration and integration assessment addresses an agreed selection of applications beyond that boundary.
Will ICA implement the recommended changes?
The assessment outputs are findings, risk priorities and improvement recommendations. Implementation is separately scoped. Your platform owners decide how to handle recommendations through their change-approval process; follow-up testing is also separately agreed.
Set a clear direction for Salesforce access improvements
Bring the rollout decision or visibility concern that needs attention. Define a Salesforce security review around the relevant orgs and data, then use documented configuration findings to guide risk priorities and practical improvement planning.
Make access decisions before expanding platform use
A rollout or expanded sensitive-data use raises access questions. Existing teams may be concerned that too many people can see sensitive information. Salesforce owners need a clear basis for discussing configuration changes with security and compliance leaders.
This assessment supports that decision. It examines the agreed environment so your team can distinguish necessary access from permissions or sharing that deserve attention. Healthcare IT teams using Health Cloud can focus the review on their actual data and workflows. Findings provide a basis for deciding which configuration improvements to prioritize.
Define the orgs, data and access paths in scope
The review covers scoped Salesforce permissions, sharing, connected applications, integrations and security configuration. Salesforce controls access at object, field and record levels. Reviewing these layers together helps explain how access assignments relate to the visibility your business intends.
Coverage starts with the Salesforce orgs and products you use. Your team identifies relevant user groups, sensitive data and integration relationships. Health Cloud is included where it is part of the agreed environment; its name alone does not establish which controls are present or how they are configured.
The scope identifies workflow and integration boundaries. Reviewing Salesforce-side integration configuration does not automatically extend the assessment into connected applications.
Compare configuration evidence with intended access
The intended method is a specialist configuration review. An administrator walkthrough and agreed configuration evidence help establish how permissions and sharing are assigned. Discussions with platform and data owners clarify which users need access for their work.
Relevant evidence may include permission assignments, sharing settings, connected-application details and integration documentation. The review compares that evidence with stated business needs. For example, a user group may have access to sensitive fields that its documented workflow does not require. Any conclusion depends on the configuration and context examined.
The review records evidence gaps. Agree access and sensitive-material handling before inspection. Vulnerability scanning and attack simulation require separate scope.
Use findings to set improvement priorities
The catalog identifies three typical outputs, with their content agreed during scoping:
Permission/configuration findings. Document the access or configuration concerns identified in the reviewed environment. Platform owners use these findings to understand the affected settings and the evidence behind each concern.
Risk priorities. Put findings in an order that reflects the data and workflows involved. Security and compliance leaders use these priorities to discuss which concerns warrant earlier attention.
Improvement recommendations. Describe practical configuration or access-management changes for the responsible owners to consider. Teams use these recommendations to plan work and evaluate dependencies before making changes.
The outputs reflect agreed coverage and available evidence. They do not imply examination of every permission assignment or integration.
Prepare the people and evidence for a focused review
Scoping establishes the review objective and the orgs, products, users, data and integrations involved. The depth of permission analysis and the complexity of sharing arrangements affect effort. Evidence availability and coordination with integration owners also influence cost and timing.
Identify an administrator who can explain configuration choices and data owners who can clarify sensitive-data use. Existing access documentation and an integration inventory help focus the review.
Agree the evidence needed, authorized access and any production constraints. Specialist platform expertise and the proposed scope must be confirmed before engagement commitments. Your organization retains control over access approval and any subsequent configuration changes.
Keep platform review and broader assurance distinct
This is a scoped configuration assessment. A full application penetration test requires a separate testing objective, authorization and scope. Application code and connected systems should not be assumed tested because their configuration relationships appear in the review.
The assessment does not guarantee HIPAA compliance. Healthcare organizations needing an organization-wide electronic protected health information risk analysis should define that broader requirement separately. Salesforce findings can inform those discussions, but a platform review alone does not establish complete coverage.
Recommendations support planning. Implementing changes, retesting and continuous monitoring require separate agreement; they are not included by default in these assessment outputs.
Salesforce security assessment questions
Who is this assessment intended for?
Salesforce owners, healthcare IT teams, CISOs and compliance leads evaluating a rollout, sensitive-data use or excessive visibility. It is useful when those teams need configuration findings to support access and improvement decisions.
Can the scope include Health Cloud and integrations?
Yes, where they are part of the agreed environment. Scoping identifies the products, data and integration boundaries to review. It also confirms relevant specialist expertise rather than assuming coverage of every connected system.
What evidence does the review need?
Agreed configuration evidence and explanations from administrators and data owners. Permission assignments, sharing settings and integration documentation may be relevant. The required detail depends on the access questions and workflows selected.
What determines cost and timing?
The number of orgs and products, user coverage, data complexity and integrations influence effort. Review depth, evidence readiness and authorized access arrangements also matter. Commercial terms follow confirmation of the proposed scope.
How does this differ from a broader SaaS security assessment?
This offer focuses on Salesforce, including Health Cloud where relevant. A broader SaaS configuration and integration assessment addresses an agreed selection of applications beyond that boundary.
Will ICA implement the recommended changes?
The assessment outputs are findings, risk priorities and improvement recommendations. Implementation is separately scoped. Your platform owners decide how to handle recommendations through their change-approval process; follow-up testing is also separately agreed.
Set a clear direction for Salesforce access improvements
Bring the rollout decision or visibility concern that needs attention. Define a Salesforce security review around the relevant orgs and data, then use documented configuration findings to guide risk priorities and practical improvement planning.