Google Cloud Compliance ControlsGoogle Cloud Essential Contacts
Organizations should have Essential Contacts configured
It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information. Prowler checks that the organization has Essential Contacts defined at the organization level.
What this control checks
Organization has Essential Contacts configured for notification categories
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 3 Incident handling
- IR-6 Incident Reporting
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
- GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
- GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
15 more clauses
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.SC-04: Suppliers are known and prioritized by criticality.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- RC.CO-03
- RC.CO-04
- RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.
- RS.CO-02: Internal and external stakeholders are notified of incidents.
- RS.CO-03: Information is shared with designated internal and external stakeholders.
- RS.MA-01
- RS.MA-04
- 1.16 Ensure Essential Contacts is Configured for Organization
- 1.16 Ensure Essential Contacts is Configured for Organization
- INQ-02.01B The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in...
- OPS-24.01B The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements.
- OPS-24.02B As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements.
- SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.
- 1.16 Ensure essential contacts is configured for Organization
- 1.16 Ensure essential contacts is configured for Organization
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.308(a)(4)(i) Information access management
- 164.308(a)(6)(ii): Administrative Safeguards
NIST Cybersecurity Framework v1.0
- RS.CO-1: Personnel know their roles and order of operations when a response is needed.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
organization_essential_contacts_configured - Powerpipe Control:
gcp_compliance.control.organization_essential_contacts_configured - Prowler Check:
iam_organization_essential_contacts_configured
Last reviewed: 2026-10-09