2

Is it possible to use ChromeOS devices within an organization that is ISO 27001 compliant?

The consultant my employer has hired to assist us in becoming ISO 27001 certified has indicated that ChromeOS devices "aren't secure". It's my understanding this certification requires computers to be able to implement logging and that these logs can't just be local to the device, but recorded on one of our company's servers.

I'm looking for confirmation that ChromeOS devices can and have been successfully used in an ISO 27001 certified company.

2

I think the requirement from ISMS point of view should be fulfilled if "logs are available all the time and their integrity isn't questionable". If they are adamant on logs availability on-premise, you can write a program/script (selenium code) to download and save the file regularly using below steps documented at http://www.dell.com/support/article/in/en/inbsdt1/SLN288529/en

To access Chrome logs:

  • Type chrome:net-internals and select Export in the drop down box.
  • Open second tab and reproduce the steps that generate the issue.
  • Go back to the tab running chrome:net-internals, type a description of the issue in the box, and click the button to save the log file. The file will be saved in the downloads folder on the Chromebook.
1

It is possible to use ChromeOS within an organisation that is ISO 27001 certified. ChromeOS devices can and have been successfully used in an ISO 27001 certified company. Ask the consultant for the exact clause of the standard that states this. Of the 114 controls, there are none that specifically exclude ChromeOS. The standard requires that logs are available, protected and regularly reviewed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.