Description

Ensure the Atlas organization has a security contact, which is a single email address that receives security-related notifications, including messages from the MongoDB Security Team. The address should belong to a monitored team mailbox rather than one person.

Rationale

If MongoDB detects a security issue that affects your organization, it needs to reach someone quickly. Without a security contact, important notices may go to the wrong person or be missed entirely, slowing your response to incidents. A monitored team address makes sure alerts are seen even when people are away.

Impact

  • Security notifications reach the right team

  • Faster response to security incidents

  • The contact does not get any access to Atlas

Default Value

By default, no security contact is set for an organization.

Pre-Requisites

  • Organization Owner role

  • A monitored email address, such as a security team mailbox

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  3. In the Atlas Contact Information section, check whether the Security Contact field has an email address.

  4. Alternatively, use the Atlas Administration API or the Atlas CLI (https://www.mongodb.com/docs/atlas/cli/current/). Run GET /api/atlas/v2/orgs/{orgId}/settings and check the securityContact value.

  5. If no security contact is set, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  3. In the Atlas Contact Information section, click Add (or the edit icon) for the Security Contact field.

  4. Enter the email address and click Save.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  3. In the Atlas Contact Information section, edit the Security Contact field to restore the previous address, and click Save.

Reference