# Ensure Security Alternate Contact is Registered

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890015182815-ensure-security-alternate-contact-is-registered
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that an AWS account has a Security alternate contact configured with a valid email address and phone number, so that AWS can reach the appropriate security team directly regarding account security matters, such as reported abuse or compromised credentials.

**Rationale**

By default, AWS communicates account-related notices only to the account's root email address, which may not be monitored by the security team and may be a shared or infrequently checked mailbox. Configuring a dedicated Security alternate contact ensures that critical, time-sensitive security notifications from AWS (for example, notifications of exposed credentials or reported account abuse) reach the team responsible for responding, reducing the time to detect and remediate a security incident.

**Impact**

-   Ensures security-related AWS notifications reach the correct team promptly
    
-   Reduces response time to reported account abuse or credential exposure
    
-   Provides AWS Support and Trust & Safety teams with a reliable point of contact
    

**Default Value**

No alternate contacts (Security, Billing, or Operations) are configured by default; only the root account email receives account communications until alternate contacts are added.

**Pre-Requisites**

-   Root user or IAM permissions to manage account settings (account:PutAlternateContact)
    
-   A monitored email address and phone number for the security team
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Account menu in the top navigation and select Account.
    
3.  Scroll to the Alternate Contacts section.
    
4.  Verify that a Security contact is populated with a name, email address, phone number, and title.
    
5.  If using AWS Organizations, verify alternate contacts are set consistently across member accounts, either individually or via the Account Management console.
    
6.  If the Security contact is missing or invalid, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Account menu and select Account.
    
3.  Scroll to the Alternate Contacts section and select Edit.
    
4.  Under Security, enter the name, title, email address, and phone number of the team or individual responsible for security matters.
    
5.  Choose Update to save the contact.
    
6.  For AWS Organizations, consider using the Account Management console or the account:PutAlternateContact API to set this consistently across all member accounts.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Account menu and select Account.
    
3.  Scroll to the Alternate Contacts section and select Edit.
    
4.  Clear the Security contact fields or remove the contact.
    
5.  Choose Update to save the change.
    

**Reference**

-   [https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html)
    
-   [https://docs.aws.amazon.com/organizations/latest/userguide/orgs\_manage\_accounts\_update-contact.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_update-contact.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.