Subscriptions should have a contact email address for security issues
To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.
To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center. Security Center emails the subscription owners whenever a high-severity alert is triggered for their subscription.
What this control checks
Subscriptions should have a contact email address for security issues
Common pitfalls
Effect defaults to AuditIfNotExists
The policy effect defaults to AuditIfNotExists. Disabled is also allowed as a value for the effect.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Subscriptions should have a contact email address for security issues" (4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7); PowerPipe controls azure_compliance.control.securitycenter_additional_email_configured and azure_compliance.control.securitycenter_email_configured.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IR-4 (Incident Handling), IR-5 (Incident Monitoring), IR-6(2) (Vulnerabilities Related to Incidents) and 1 more clause.
NIST Cybersecurity Framework v2.0: Mapped to DE.AE-02 (Potentially adverse events are analyzed to better understand associated activities.), RC.CO-03 (Recovery activities and progress in restoring operational capabilities are communicated to designated internal and...) and RS.MA-01 (The incident response plan is executed in coordination with relevant third parties once an incident is declared.).
FedRAMP Moderate Baseline Rev 4: Mapped to IR-4 (Incident Handling) and IR-5 (Incident Monitoring).
Framework mappings
The clauses this control is mapped to in each framework.
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- IR-6(2) Vulnerabilities Related to Incidents
- SI-4(12) Automated Organization-Generated Alerts
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- RC.CO-03
- RS.MA-01
FedRAMP Moderate Baseline Rev 4
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
- 3.14.3 Monitor system security alerts and advisories and take action in response
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 1 IT Governance
- 3.1.c Role based Access Control
- 3.1.f Maker-checker
- IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
- SI.L2-3.14.3 Monitor system security alerts and advisories and take action in response
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- IR-4 Incident Handling
- IR-5 Incident Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_email_configured - Powerpipe Controls:
azure_compliance.control.securitycenter_additional_email_configured,azure_compliance.control.securitycenter_email_configured - Azure Policy Definition:
4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7
Last reviewed: 2026-10-15