Back to Checks
mongodbatlas

Organization has a security contact defined

organizations_security_contact_defined
Service: organizationsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:NotDefined

MongoDB Atlas organizations specify a designated security contact email to receive security notifications and advisories.

Assesses whether this contact is configured at the organization level.

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Missing or stale security contact causes critical advisories and incident alerts to be missed or delayed, slowing containment and patching. This elevates risks to confidentiality (undetected data access), integrity (malicious changes persist), and availability (abuse or outages escalate).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks organizations_security_contact_defined

Recommendation

Define a monitored distribution list as the security contact.

  • Ensure 24/7 coverage and escalation
  • Keep it current and test delivery
  • Integrate with IR/ticketing workflows
  • Apply least privilege and document ownership

Remediation

CLI

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<ORG_ID>/settings" -d '{"securityContact":"<EMAIL_ADDRESS>"}'

Other

1Sign in to MongoDB Atlas
2In the top bar, select your organization from the Organizations menu
3Go to Organization Settings
4In Atlas Security Contact Information, click Edit
5Enter the security contact email and click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.organizations.organizations_client import (
    organizations_client,
)


class organizations_security_contact_defined(Check):
    """Check if organization has a Security Contact defined

    This class verifies that MongoDB Atlas organizations have a security contact
    defined to receive security-related notifications.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas organization security contact defined check

        Iterates over all organizations and checks if they have a security contact
        defined to receive security-related notifications.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each organization
        """
        findings = []

        for organization in organizations_client.organizations.values():
            report = CheckReportMongoDBAtlas(
                metadata=self.metadata(), resource=organization
            )

            if organization.settings.security_contact:
                report.status = "PASS"
                report.status_extended = (
                    f"Organization {organization.name} has a security contact defined: "
                    f"{organization.settings.security_contact}"
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Organization {organization.name} does not have a security contact "
                    f"defined to receive security-related notifications."
                )

            findings.append(report)

        return findings

References