Control: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User

Configures auditing against a CIS Benchmark item.

Level: 1

It is recommended that the super admin role is assigned to a dedicated email address (e.g., gcp-superadmin@company.com) rather than to individual user email addresses (e.g., john.doe@company.com). The dedicated super admin email should be a separate user account used exclusively for super admin level administrative tasks.

When you first sign up for Google Workspace or Cloud Identity, the person who completes the signup process automatically becomes the first super administrator for that account. When the GCP organization resource is created, existing super administrator accounts from Google Workspace or Cloud Identity automatically gain access to manage the organization. This initial assignment typically results in an individual user's email address being assigned the super admin role by default. The super admin role has unrestricted access to all GCP organization resources and settings. Using individual user email addresses for super admin access creates security and operational risks.