Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email
Microsoft Defender for Cloud security contact settings should include additional email recipients defined in the `emails` field to receive alert notifications. Subscriptions should have a contact email address for security issues.
Relying only on subscription owners for alerts creates a single point of failure. Missed or delayed notifications extend attacker dwell time, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and service disruption (availability). Absence or turnover can silently suppress alerts.
What this control checks
Defender for Cloud security contact has additional email addresses set in the emails field
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_additional_email_configured_with_a_security_contact (prowler azure --checks defender_additional_email_configured_with_a_security_contact); PowerPipe controls azure_compliance.control.securitycenter_additional_email_configured and azure_compliance.control.securitycenter_email_configured.
Framework-specific interpretation
SOC 2: Mapped to CC4.2 (COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
PCI DSS v4.0: Mapped to A1.2.3 (Multi-tenant service providers facilitate logging and incident response for all customers.).
NIS2 Directive (EU 2022/2555): Mapped to 3.1.2.c (assignment of roles to detect and appropriately respond to incidents to competent employees;), 3.5.1 (The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner.), 3.5.3.a (with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to...) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
- 3 Incident handling
- 4 Business continuity and crisis management
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 8.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- INQ-02.01B The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in...
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
3 more clauses
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
- SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.
- SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.
- 2.13 Ensure 'Additional email addresses' is configured with a security contact email
- 2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 2.3.2 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 2.1.19 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 164.308(a)(6)(i) Security incident procedures
- 164.308(a)(6)(ii): Administrative Safeguards
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_additional_email_configured - Powerpipe Controls:
azure_compliance.control.securitycenter_additional_email_configured,azure_compliance.control.securitycenter_email_configured - Prowler Check:
defender_additional_email_configured_with_a_security_contact
Last reviewed: 2026-10-14