# 1.16 Ensure Essential Contacts Are Configured for the Organization (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232945-1-16-ensure-essential-contacts-are-configured-for-the-organization-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: Level 1 ### Description: Essential Contacts allow organizations to designate specific email addresses to receive important notifications from Google Cloud services. This ensures timely communication about technical, security, legal, and other critical information. Configuring Essential Contacts is recommended to improve notification management. ### Rationale: By default, Google Cloud notifications are sent to users with specific IAM roles. However, this method may result in missed notifications if roles are misconfigured or users are unavailable. Essential Contacts allow organizations to: - Specify exact recipients for notifications. - Ensure timely awareness of legal, security, and technical issues. - Streamline communication with Google Cloud services. ### Impact: There is no additional cost for configuring Essential Contacts, except for the Technical Incidents category, which requires a premium support plan. ### Default Value: By default, no Essential Contacts are configured. In their absence, Google Cloud sends notifications to users with the following IAM roles: ### Audit Steps: Using Google Cloud Console: 1. Go to Essential Contacts:                             ![](https://support.icompaas.com/assets/kb/cb526cc77e939497.png) 2. Ensure the organization is selected in the resource selector at the top of the page.                               ![](https://support.icompaas.com/assets/kb/7563faf87912a2f5.png) 3. Verify that email addresses are configured for the following categories: - Legal - Security - Suspension - Technical - Alternatively, ensure that an email address is configured for the All category, covering all notifications. Using Google Cloud CLI: List all configured Essential Contacts: gcloud essential-contacts list --organization= 1. Confirm that at least one email address is assigned to the following categories: - LEGAL - SECURITY - SUSPENSION - TECHNICAL - Alternatively, ensure an address is configured for the ALL category. ### Remediation Steps: Using Google Cloud Console: 1. Navigate to Essential Contacts:                      ![](https://support.icompaas.com/assets/kb/0a9acb8423d9edfa.png) 2. Ensure the organization is selected in the resource selector. 3. Click + Add Contact.                                      ![](https://support.icompaas.com/assets/kb/57859080747bc005.png) 4. Enter the email address in the Email and Confirm Email fields.                                                         ![](https://support.icompaas.com/assets/kb/cf3f02be59e6a1dc.png) 5. From the Notification Categories dropdown, select the relevant categories (e.g., Legal, Security, Suspension, Technical).                                                        ![](https://support.icompaas.com/assets/kb/13ae99a1eba7c9db.png) 6. Click Save.                                                                                         ![](https://support.icompaas.com/assets/kb/3688987c31f3d770.png) Using Google Cloud CLI: Add an Essential Contact: gcloud essential-contacts create --email="" \\ --notification-categories="" \\ --organization= Example: gcloud essential-contacts create --email="security@example.com" \\ --notification-categories="SECURITY,TECHNICAL" \\ --organization=1234567890 - Legal: roles/billing.admin - Security: roles/resourcemanager.organizationAdmin - Suspension: roles/owner - Technical: roles/owner - Technical Incidents: roles/owner ## Backout Plan: 1\. Restore Essential Contact Information (If Needed) If an Essential Contact was mistakenly removed, re-add it using: gcloud essential-contacts create --email="" \\ --notification-categories="SECURITY,LEGAL" \\ --organization= 2\. Restore IAM Policy from Backup If necessary, restore a previous IAM policy: gcloud projects set-iam-policy PROJECT\_ID policy-backup.json ### ### References: 1. [Managing Notification Contacts](https://cloud.google.com/resource-manager/docs/managing-notification-contacts) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

17.2 Establish and Maintain Contact Information

Maintain contact information for parties who need to be informed of security incidents. Verify annually for accuracy.

✅

✅

✅

19.5 Maintain Incident Reporting Contacts

Maintain a list of external and internal contacts for reporting security incidents.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.