cis-aws-foundations-2-3

name	cis-aws-foundations-2.3
description	Ensure security contact information is registered
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","account","security-contact","alternate-contact"]
cis_id	2.3
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.2"]
prerequisites	[]
severity_boost	{}

Ensure security contact information is registered

Description

AWS provides customers with the option to specify contact information for the account's security team. It is recommended that this information be configured. In AWS Organizations environments, this applies to all member accounts.

Rationale

Specifying security-specific contact information helps ensure that security advisories sent by AWS reach the team within your organization that is best equipped to respond to them.

Impact

Missing or incorrect security contact information may delay response to AWS security notifications, increasing the risk of prolonged exposure to security threats.

Audit Procedure

Using AWS Console

1. Click on your account name at the top right corner of the console.
2. From the drop-down menu, Click Account.
3. Scroll down to the Alternate Contacts section.
4. Ensure contact information is specified in the Security contact section.

Using AWS CLI

1. Run the following command:

aws account put-alternate-contact --alternate-contact-type SECURITY --email-address "" --name "" --phone-number ""

2. Ensure proper contact information is specified for the Security contact.

Expected Result

Security contact information is configured with valid email, name, and phone number for the security team. The email should ideally be a distribution list monitored by more than one individual.

Remediation

Using AWS Console

1. Click on your account name at the top right corner of the console.
2. From the drop-down menu click My Account.
3. Scroll down to the Alternate Contacts section.
4. Enter contact information in the Security section.

Using AWS CLI

Run the following command with the following input parameters: --email-address, --name, and --phone-number.

aws account put-alternate-contact --alternate-contact-type SECURITY --email-address "" --name "" --phone-number ""

Note: Consider specifying an internal email distribution list to ensure emails are regularly monitored by more than one individual.