Route role addresses to monitored mailboxes, queues or groups with named owners.
Use delegated access instead of a shared password where the platform supports it.
Apply normal anti-phishing and malware controls, because public role addresses receive hostile mail by design.
Document who handles reports and what should be escalated.
Periodically test that required addresses still accept mail and reach somebody responsible.