.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
About
When you connect Heroku to DSALTA, the platform lists your Heroku members using read-only API access and verifies each has two-factor authentication enabled. DSALTA evaluates this control on every sync.Why This Matters
A password alone is a single point of failure. If it is phished, guessed, or reused from a breached site, an attacker gains access. Two-factor authentication adds a second verification step that blocks the vast majority of account-takeover attempts and is a baseline requirement across SOC 2, ISO 27001, and most security frameworks.How to Fix
Before you begin- Ensure you have admin access to your Heroku team.
- In Heroku, open Account settings and enable two-factor authentication.
- Enforce an org-wide MFA policy so every team member must enroll.
- Communicate the change to your team and set an enrollment deadline.
Frequently Asked Questions
How often does this check run?
How often does this check run?
This check runs automatically every 24 hours while the Heroku integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
What happens if it keeps failing?
What happens if it keeps failing?
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once every member has 2FA enabled, the status updates automatically on the next sync.
Can I exclude this check?
Can I exclude this check?
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
Does DSALTA change my Heroku configuration?
Does DSALTA change my Heroku configuration?
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Heroku.