Manage your Salesforce security contacts

Note Salesforce updates are subject to change beyond our control. Sage People attempts to maintain our content in alignment: for the most up to date information, refer to Salesforce documentation.

What's happening?

Salesforce uses designated Security Contacts to communicate important security information, including notifications relating to security incidents that may affect your Salesforce organization. Salesforce recommends that organisations ensure their Security Contact information remains accurate and up to date.

This contact applies to Salesforce contacting you. Sage People maintain our own list of contacts through our communication with you and will use these to contact you.

Will this affect you?

This is relevant if your organization uses Sage People and Salesforce, and you want to ensure Salesforce contacts the correct individuals they need to communicate information about a security event.

You may need to review your existing Security Contacts if:

  • The individuals responsible for security or Salesforce administration have changed

  • Contact details are out of date

  • You currently rely on a single individual to receive security notifications

Recommended action

We recommend that you review your Security Contact details and confirm they're still appropriate for your organization.

When selecting Security Contacts, Sage recommends:

  • Ensuring your Primary System administrator is one of the contacts

  • Adding more than one contact where possible

  • Considering the use of a distribution list or shared mailbox to reduce the risk of missing important notifications

How to update Security Contacts

  1. Login to your Production Salesforce organization.

  2. Go to Setup.

  3. In the quick find box, search for Company Information and select it.

  4. Click Edit at the top of the page.

  5. Scroll to the Security Contact Information section.

  6. Enter the following mandatory information:

    • Name: the full name of a specific individual responsible for security decisions

    • Email: a valid email address. Standard formats are permitted, including individual user emails or organizational distribution lists

    • Phone: a direct line to the identified security contact. This must be a number where a specific person can be reached for urgent outreach and shouldn’t be a generic support team line

  7. Click Save.

Why this matters

Keeping Security Contacts up to date helps ensure that important security communications reach the right people quickly. If Salesforce identifies a security issue that requires customer awareness or action, they send notifications to the Security Contacts registered against your organization.

For more information, see the Salesforce article Managing your security contact in Salesforce.