Skip to main content

🛡️ Google Organization Essential Contacts is not configured🟢

  • Contextual name: 🛡️ Organization Essential Contacts is not configured🟢
  • ID: /ce/ca/google/iam/essential-contacts-for-organization
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.

Rationale​

Many Google Cloud services, such as Cloud Billing, send out notifications to share important information with Google Cloud users. By default, these notifications are sent to members with certain Identity and Access Management (IAM) roles. With Essential Contacts, you can customize who receives notifications by providing your own list of contacts.

Impact​

There is no charge for Essential Contacts except for the 'Technical Incidents' category that is only available to premium support customers.

Audit​

From Google Cloud Console​
  1. Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts
  2. Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.

... see more

Remediation​

Open File

Remediation​

From Google Cloud Console​

  1. Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts
  2. Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.
  3. Click +Add contact
  4. In the Email and Confirm Email fields, enter the email address of the contact.
  5. From the Notification categories drop-down menu, select the notification categories that you want the contact to receive communications for.
  6. Click Save

From Google Cloud CLI​

  1. To add an organization Essential Contacts run a command:

    gcloud essential-contacts create --email="<EMAIL>" \

    --notification-categories="<NOTIFICATION_CATEGORIES>" \

    --organization=<ORGANIZATION_ID>

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.3.0 → 💼 1.16 Ensure Essential Contacts is Configured for Organization - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 1.16 Ensure Essential Contacts is Configured for Organization - Level 1 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 1.16 Ensure Essential Contacts is Configured for Organization - Level 1 (Automated)1no data
💼 Cloudaware Framework → 💼 General Access Controls11no data
💼 FedRAMP High Security Controls → 💼 IR-6 Incident Reporting (L)(M)(H)21013no data
💼 FedRAMP Low Security Controls → 💼 IR-6 Incident Reporting (L)(M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 IR-6 Incident Reporting (L)(M)(H)213no data
💼 ISO/IEC 27001:2022 → 💼 5.5 Contact with authorities23no data
💼 ISO/IEC 27001:2022 → 💼 5.6 Contact with special interest23no data
💼 ISO/IEC 27001:2022 → 💼 5.20 Addressing information security within supplier agreements23no data
💼 ISO/IEC 27001:2022 → 💼 5.24 Information security incident management planning and preparation23no data
💼 NIST CSF v1.1 → 💼 RS.CO-1: Personnel know their roles and order of operations when a response is needed1no data
💼 NIST CSF v2.0 → 💼 PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind8no data
💼 NIST CSF v2.0 → 💼 RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders1no data
💼 NIST CSF v2.0 → 💼 RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved18no data
💼 NIST CSF v2.0 → 💼 RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved18no data
💼 NIST CSF v2.0 → 💼 RS.AN-08: An incident's magnitude is estimated and validated1no data
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents31no data
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders19no data
💼 NIST CSF v2.0 → 💼 RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared1no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated25no data
💼 NIST CSF v2.0 → 💼 RS.MA-03: Incidents are categorized and prioritized1no data
💼 NIST CSF v2.0 → 💼 RS.MA-04: Incidents are escalated or elevated as needed1no data
💼 NIST SP 800-53 Revision 5 → 💼 IR-6 Incident Reporting31no data
💼 SOC 2 → 💼 CC2.3-1 Communicates to External Parties1no data