Organizations should have Essential Contacts configured
It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information. Prowler checks that the organization has Essential Contacts defined at the organization level.
Missing Essential Contacts means security, abuse, and billing notices can go unnoticed or to inappropriate recipients, slowing response. Consequences: data exposure via unaddressed alerts (C), unauthorized changes persisting (I), and suspensions/outages from unresolved issues (A).
What this control checks
Organization has Essential Contacts configured for notification categories
Common pitfalls
All five categories must be subscribed or ALL
The check returns ok when LEGAL, SECURITY, SUSPENSION, TECHNICAL and TECHNICAL_INCIDENTS are all subscribed. It also returns ok when ALL is subscribed, otherwise alarm.
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_organization_essential_contacts_configured (prowler gcp --checks iam_organization_essential_contacts_configured); PowerPipe control gcp_compliance.control.organization_essential_contacts_configured.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 1.1.1.a (set out the relevant entities approach to managing the security of their network and information systems;), 3.1.2.d (documents to be used in the course of incident detection and response such as incident response manuals, escalation...) and 3.5.3.a (with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to...).
NIST SP 800-53 Rev 5: Mapped to IR-6 (Incident Reporting).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-01 (The organizational mission is understood and informs cybersecurity risk management.), GV.OC-02 (Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk...), GV.OC-04 (Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization...) and 17 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 3 Incident handling
- IR-6 Incident Reporting
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
- GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
- GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
15 more clauses
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.SC-04: Suppliers are known and prioritized by criticality.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- RC.CO-03
- RC.CO-04
- RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.
- RS.CO-02: Internal and external stakeholders are notified of incidents.
- RS.CO-03: Information is shared with designated internal and external stakeholders.
- RS.MA-01
- RS.MA-04
- 1.16 Ensure Essential Contacts is Configured for Organization
- 1.16 Ensure Essential Contacts is Configured for Organization
- INQ-02.01B The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in...
- OPS-24.01B The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements.
- OPS-24.02B As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements.
- SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.
- 1.16 Ensure essential contacts is configured for Organization
- 1.16 Ensure essential contacts is configured for Organization
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.308(a)(4)(i) Information access management
- 164.308(a)(6)(ii): Administrative Safeguards
NIST Cybersecurity Framework v1.0
- RS.CO-1: Personnel know their roles and order of operations when a response is needed.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
organization_essential_contacts_configured - Powerpipe Control:
gcp_compliance.control.organization_essential_contacts_configured - Prowler Check:
iam_organization_essential_contacts_configured
Last reviewed: 2026-10-09