Check ID: organizations_security_contact_defined
Provider: MongoDB Atlas
Service: organizations
Severity: MEDIUM
Categories: resilience
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas organizations specify a designated security contact email to receive security notifications and advisories. Assesses whether this contact is configured at the organization level.

​
Risk

Missing or stale security contact causes critical advisories and incident alerts to be missed or delayed, slowing containment and patching. This elevates risks to confidentiality (undetected data access), integrity (malicious changes persist), and availability (abuse or outages escalate).

​
Recommendation

Define a monitored distribution list as the security contact.
  • Ensure 24/7 coverage and escalation
  • Keep it current and test delivery
  • Integrate with IR/ticketing workflows
  • Apply least privilege and document ownership

​
Remediation

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<ORG_ID>/settings" -d '{"securityContact":"<EMAIL_ADDRESS>"}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_security_contact_defined. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks