Organization has Essential Contacts configured

Check ID: iam_organization_essential_contacts_configured
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: resilience
Resource type: cloudresourcemanager.googleapis.com/Organization

What this check verifies

Google Cloud organization has Essential Contacts defined at the organization level for categories such as SECURITY, BILLING, LEGAL, SUSPENSION, TECHNICAL, or PRODUCT_UPDATES. Evaluates whether at least one contact is configured.

Risk

Missing Essential Contacts means security, abuse, and billing notices can go unnoticed or to inappropriate recipients, slowing response. Consequences: data exposure via unaddressed alerts (C), unauthorized changes persisting (I), and suspensions/outages from unresolved issues (A).

Recommendation

Configure Essential Contacts at the organization (and inherit to folders/projects) with group aliases for SECURITY, BILLING, LEGAL, SUSPENSION, TECHNICAL, and PRODUCT_UPDATES. Apply least privilege and separation of duties. Review quarterly, verify delivery, and restrict contacts to approved domains.

Remediation

CLI
Terraform
Dashboard steps

gcloud essential-contacts create --email=<EMAIL> --notification-categories=all --organization=<ORGANIZATION_ID>

resource "google_essential_contacts_contact" "<example_resource_name>" {
  parent = "organizations/<example_resource_id>"            # Critical: set at org level to satisfy the check
  email  = "<EMAIL>"                                        # Critical: creates the essential contact
  notification_category_subscriptions = ["ALL"]             # Critical: required; ensures the contact is created
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_organization_essential_contacts_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

No project-level Service Account User or Token Creator roles Cloud KMS roles enforce separation of duties

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires