Google Workspace

Prevention

(DLP) features to use with Chrome to implement sensitive data detection for files that are uploaded and downloaded and for content that is pasted or dragged and dropped. The DLP integration with Chrome scans and reports findings from up to 10MB of the text content extracted from each file. Note: Chrome Enterprise Premium threat and data protection features are available only for customers who have purchased Chrome Enterprise Premium Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● DLP with Chrome Control Domain Access Control Control # AC.L2-3.1.9 Control Description Provide privacy and security notices consistent with applicable CUI rules. 134 Google Workspace Chrome Policy: Custom Control Responsibility Enabling Features Terms of Service Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policy: Custom Terms of Service A description of each feature and implementation guidance is included below. Chrome Policy: Custom Terms of Service You can upload a custom privacy or security notice that users must accept before they can sign in to start a session. Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations: ● Only available on ChromeOS devices. Supplemental Guidance ● Chrome Policy: Custom Term of Service Control Domain Access Control Control # AC.L2-3.1.10 Control Use session lock with pattern-hiding displays to prevent access and viewing of Description data after a period of inactivity. Google Workspace Chrome Policy: Browser Control Responsibility Enabling Features Idle Timeout Google Chrome Policy: Idle Shared Settings X Customer Customer Implementation Description 135 When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policy: Browser Idle Timeout ● Chrome Policy: Idle Settings A description of each feature and implementation guidance is included below. Chrome Policy: Browser Idle Timeout You can select what actions the browser performs when idle for a specified period of time. This feature is available on iOS devices and Chrome browser for Windows, Mac, and Linux. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Policy: Idle Settings This Chrome Policy controls actions performed when the user closes the Chromebook lid or when the AC/Battery is idle. To configure the idle settings: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings. 3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). 4. Click Idle Settings a. Select if you want a user's device to go to sleep, sign them out, shut down, or do nothing, when they idle when connected to AC power or battery power. The default is Sleep. b. Select if you want a user's device to go to sleep, sign them out, shut down, or do nothing, when they close the device lid. The default for user sessions is Sleep and the default for managed guest sessions is Logout. 5. Click Save. Or, you might click Override for an organizational unit . Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome Policy: Browser Idle Timeout ● Chrome Policy: Idle Settings 136 Control Domain Access Control Control # AC.L2-3.1.11 Control Description Terminate (automatically) a user session after a defined condition. Google Workspace Chrome Policy: Maximum Control Responsibility Enabling Features user session length Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policy: Maximum user session length A description of each feature and implementation guidance is included below. Maximum user session length This Chrome Policy controls how long user sessions last. The remaining session time is shown on a countdown timer in the user's system tray. After the specified time, users are automatically signed out and the session ends. Enter a value between 1 and 1440 minutes (24 hours). For unlimited sessions, do not enter a value. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome Policy: Maximum user session length Control Domain Access Control Control # AC.L2-3.1.12 Control Description Monitor and control remote access sessions. Google Workspace Chrome Remote Control Responsibility Enabling Features Desktop Google ChromeOS Remote Shared Access X Customer 137 Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Remote Desktop ● ChromeOS Remote Access A description of each feature and implementation guidance is included below. Chrome Remote Desktop Chrome Remote Desktop allows your users to use a computer or mobile device to access files and applications on another computer with Chrome Remote Desktop. As an administrator, you can control whether users can use Chrome Remote Desktop. 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Apps and then Additional Google services. 3. Click Chrome Remote Desktop. 4. Click Service status. 5. To turn a service on or off for everyone in your organization, click On for everyone or Off for everyone, and then click Save. 6. To change the Service status, select On or Off. 7. Choose one: ● If the Service status is set to Inherited and you want to keep the updated setting, even if the parent setting changes, click Override. ● If the Service status is set to Overridden, either click Inherit to revert to the same setting as its parent, or click Save to keep the new setting, even if the parent setting changes. ChromeOS Remote Access As a Chrome Enterprise administrator, you can remotely access and troubleshoot ChromeOS devices, including kiosk devices, by starting a Chrome Remote Desktop session from the Google Admin console. All remote connection sessions are logged in the Admin audit log under ChromeOS Device Command. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome Remote Desktop ● ChromeOS Remote Access 138 Control Domain Access Control Control # AC.L2-3.1.15 Control Description Authorize remote execution of privileged commands and remote access to security-relevant information. Google Workspace Admin Roles Control Responsibility Enabling Features Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Admin Roles A description of each feature and implementation guidance is included below. Admin Roles When you specify privileges in the Admin Console, you can also grant remote access to managed ChromeOS devices. For example, if a role is assigned the Chrome Management privileges, then users with this role can manage your organization’s Chrome devices and policies, including: ● Start Remote Desktop Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Admin Roles Control Domain Access Control Control # AC.L2-3.1.16 Control Description Authorize wireless access prior to allowing such connections. Google Workspace Device Networks Control Responsibility Enabling Features Google Shared 139 X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Device Networks A description of each feature and implementation guidance is included below. Device Networks As an administrator, you can automatically add configured Wi-Fi networks to company-managed mobile and ChromeOS devices. However, you will still need to configure and manage the Wi-Fi network outside of Google Workspace. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Device Networks Control Domain Access Control Control # AC.L2-3.1.17 Control Description Protect wireless access using authentication and encryption. Google Workspace Device Networks Control Responsibility Enabling Features Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Device Networks A description of each feature and implementation guidance is included below. Device Networks 140 As an administrator, you can automatically add configured Wi-Fi networks to company-managed mobile and ChromeOS devices. However, you will still need to configure and manage the Wi-Fi network outside of Google Workspace. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Device Networks Control Domain Access Control Control # AC.L1-3.1.20 Control Description Verify and control/limit connections to and use of external systems. Google Workspace Chrome URL Blocklist or Control Responsibility Enabling Features Allowlist Google Chrome Enterprise Shared Connectors Framework X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome URL Blocklist or Allowlist ● Chrome Enterprise Connectors Framework ● Local and Network Printers A description of each feature and implementation guidance is included below. Chrome URL Blocklist or Allowlist As a Chrome Enterprise admin, you can block and allow URLs so that users can only visit certain websites. Restricting users’ internet access can increase productivity and protect your organization from viruses and malicious content found on some websites. To configure a URL Blocklist or Allowlist: 1. In the Admin console, go to Menu and then Devices and then Chrome and then Settings. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings. 141 2. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group. 3. Go to Content. 4. Click URL Blocking and enter URLs as needed: a. Blocked URLs—URLs that you want to prevent users from accessing. b. Blocked URL exceptions—URLs that you want to allow users to access (allowlist). Access is allowed even if the URLs are also defined in Blocked URLs. 5. You can block and allow up to 1,000 URLs. 6. Click Save. Chrome Enterprise Connectors Framework Chrome Enterprise Connectors Framework offers a collection of connectors and APIs that simplify the steps needed to integrate Chrome browser and ChromeOS with solution providers. As an admin, you can use the Google Admin console to get Chrome to report events to third-party service providers. For example, you can configure Chrome to report security events such as malware transfer, unsafe site visits, and password reuse. You can let Chrome report events using multiple service providers and configurations at the same time. Customers interested in using this feature can use the link in the supplemental guidance for more information. Local and Network Printers As an administrator, you can use Common UNIX Printing System (CUPS) printers with your organization’s ChromeOS devices. CUPS uses an Internet Printing Protocol (IPP) to print to local and network printers. You can also track print jobs and printer usage in your organization. You can add and specify a printer for everyone, or for users or devices in certain groups or departments. Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations 1. Alternatively, you can use Google Workspace to configure the networks that company-managed mobile devices, ChromeOS devices, and Google meeting room hardware use. You can control Wi-Fi, Ethernet, and Virtual Private Network (VPN) access, and set up network certificates. When you add a network configuration, you can apply the same network settings for your entire organization, or enforce specific network settings for different organizational units. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance 142 ● Chrome URL Blocklist or Allowlist ● Chrome Enterprise Connectors Framework ● Network Management ● Local and Network Printers Control Domain Audit & Accountability Control # AU.L2-3.3.1 Control Description Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. Google Workspace Chrome browsers log Control Responsibility Enabling Features events Google Chrome log events Shared Chrome Sync log events X Customer Chrome Management Telemetry API Customer Implementation Description 143 When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome browsers log events ● Chrome log events ● Chrome Sync log events ● Chrome Management Telemetry API A description of each feature and implementation guidance is included below. Chrome browsers log events As an administrator, you can use the security investigation tool to view and investigate live-state data about Chrome browsers in your organization. For example: ● Investigate if a browser update has reached all devices in your organization. ● Inspect the details of browser devices where phishing events often occur. The report can help identify if a bad extension is responsible for the unsafe events. ● View which devices have a specific user signed in, and assess the potential damage made to different devices and browsers. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome log events As your organization's administrator, you can run searches and take action on security issues related to Chrome log events in Google Workspace. For example, you can view a record of actions to track events related to managed Chrome browsers and ChromeOS devices. You can also see when there has been an unsafe site visit. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Sync log events As your organization's administrator, you can run searches and take action on security issues related to Chrome Sync log events in Google Workspace. You can view a record of actions taken by users who have Chrome Sync enabled—for example, if a user deleted a bookmark, installed a new Chrome extension, or logged into Chrome on a new device. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Management Telemetry API As a Chrome administrator, you can use the Chrome Telemetry API to monitor the operation and health of Chrome OS devices, including: ● CPU information and telemetry 144 ● Memory information and telemetry ● Graphics information and telemetry ● Battery information and telemetry ● Storage information and telemetry ● Network information ● OS update status Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome browsers log events ● Chrome log events ● Chrome Sync log events ● Chrome Management Telemetry API Control Domain Audit & Accountability Control # AU.L2-3.3.4 Control Description Alert in the event of an audit logging process failure. Google Workspace Security Investigation Control Responsibility Enabling Features Tool Google Chrome Management Shared Telemetry API X Customer notifications Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Security investigation tool ● Chrome Management Telemetry API notifications A description of each feature and implementation guidance is included below. Security Investigation Tool As an administrator, you can create an activity rule that alerts you or takes action based on any search that you configure in the investigation tool. After you configure the activity rule, 145 Google will continuously perform a search that you have specified in the rule. If the number of results returned by that search exceeds the threshold that you have set up, then Google will perform the actions that you specify. For example, you can set up a rule to send email notifications to certain administrators if Drive documents are shared outside the company. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Management Telemetry API notifications As a Chrome administrator, you can use the Chrome Telemetry API to monitor the operation and health of ChromeOS devices, helping you with root cause analysis and troubleshooting. Using Chrome Management Telemetry API notifications, you can subscribe to and receive Telemetry API event notifications using Google Cloud Pub/Sub. Using Google Cloud Pub/Sub, you can create a system of event producers and consumers, called publishers and subscribers. This system streams analytics and data integration pipelines to receive and distribute data. Publishers communicate with subscribers asynchronously by broadcasting events. You can create notifications when the Chrome Management Telemetry API stops sending event notifications. Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations ● Chrome Management Telemetry API notifications requires a Google Cloud Platform (GCP) account Supplemental Guidance ● Security Investigation Tool ● Chrome Management Telemetry API notifications Control Domain Audit & Accountability Control # AU.L2-3.3.5 Control Description Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. 146 Google Workspace Device Reports Control Responsibility Enabling Features Chrome Browser and Google Profile reporting Shared Chrome Insights report X Customer Chrome Enterprise reporting connectors Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Device Reports ● Chrome Browser and Profile reporting ● Chrome Insights report ● Chrome Enterprise reporting connectors A description of each feature and implementation guidance is included below. Device Reports As your organization's administrator, you can use device reports to see trends or an overview of information about devices running Chrome OS and mobile devices that are used in your organization. You can also change the data you see in reports and export your report data. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Browser and Profile reporting As an administrator, you can view reports in the Google Admin console to review managed Chrome browser and profile information in your organization. You can turn on managed browser reporting to get a detailed view of Chrome browsers and extensions used in your organization. You can turn on managed profile reporting to view profile-level information, browser-level information, and limited device information. Finally, you can turn on browser event reporting to report browser events such as password reuse, malware downloads, extension installs, and make these available in the Admin console. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Insights report As an admin, you can use the Google Admin console to see insights about the ChromeOS devices and Chrome browsers in your organization. On the Chrome Insights Report page, you can see the following reports: ● Devices receiving their last automatic update 147 ● Devices That Need Attention ● Device Fleet Hardware Report ● Browsers that need attention Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Enterprise reporting connectors As an admin, you can use the Google Admin console to get Chrome to report events to third-party service providers. For example, you can configure Chrome to report security events such as malware transfer, unsafe site visits, and password reuse. You can let Chrome report events using multiple service providers and configurations at the same time. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Device Reports ● Chrome Browser and Profile reporting ● Chrome Insights report ● Chrome Enterprise reporting connectors Control Domain Configuration Management Control # CM.L2-3.4.1 Control Description Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Google Workspace Chrome Policies for Control Responsibility Enabling Features Users or Browsers Google ChromeOS Device Shared Policies X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policies for Users or Browsers ● ChromeOS Device Policies 148 A description of each feature and implementation guidance is included below. Chrome Policies for Users or Browsers Administrators who choose to use Chrome Policies for Users or Browsers should establish a baseline configuration for their users or browsers. Customers interested in using this feature can use the link in the supplemental guidance for more information. As an administrator, you can use your Google Admin console to find details about enrolled Chrome browsers. You can review information such as enrollment dates, installed extensions, applied policies, and more. To view browser information: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Managed browsers. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browserand thenManaged browsers. 3. (Optional) On the left, select an organizational unit. By default, all browsers are shown. ChromeOS Policies As a Chrome Enterprise admin, you should establish a baseline configuration for devices that run ChromeOS. You can manage policies and settings for Chromebooks and other devices that run ChromeOS from the cloud-based Google Admin console. You can control settings that apply when people use a managed ChromeOS device, such as a Chromebook. Device-level settings apply for anyone who uses the device, even if they sign in as a guest or with a personal Gmail account. On the Device settings page, you can set policies that apply to anyone who uses a managed ChromeOS device, even if they sign in as a guest or with a personal Gmail account. Customers interested in using this feature can use the link in the supplemental guidance for more information. As an administrator, you can find details about the ChromeOS devices in your domain in the Google Admin console. To view the device list page, go to Menu and then Devices and then Chrome and then Devices. Click the serial number of any device to view device details. You can also create organizational units to apply settings to different groups of devices. Customers interested in using this feature can use the link in the supplemental guidance for more information. 149 Additional Considerations 1. The Center for Internet Security (CIS) is a nonprofit that promotes best practices for securing IT systems and data. They publish a variety of materials including CIS Benchmarks. The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments. You can access the CIS Benchmarks for configuration of Chrome Browser and ChromeOS on the CIS website. Please refer to the supplemental guidance for a direct link. Supplemental Guidance ● Chrome Policies for Users or Browsers ● View Chrome browser details ● ChromeOS Device Policies ● View ChromeOS device list and details ● CIS Benchmarks for Google Chrome Control Domain Configuration Management Control # CM.L2-3.4.2 Control Description Establish and enforce security configuration settings for information technology products employed in organizational systems. Google Workspace Chrome Policies for Control Responsibility Enabling Features Users or Browsers Google ChromeOS Device Shared Policies X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policies for Users or Browsers ● ChromeOS Device Policies A description of each feature and implementation guidance is included below. Chrome Policies for Users or Browsers Administrators who choose to deploy Chrome browsers across corporate Windows, Mac, or Linux computers have two options to manage Chrome browsers from the Google Admin console: Chrome Enterprise Core (recommended), or through signed-in user based policies. 150 You can enforce Chrome policies from your Admin console that apply to: ● User accounts to sync policies and preferences across a user's devices. Settings apply whenever the user signs in to Chrome browser with their managed account on any device. ● Enrolled browsers to enforce policies when users open Chrome browser on managed Microsoft Windows, Apple Mac, or Linux computers. Signing in is not required. Administrators who choose to use Chrome Policies for Users or Browsers should establish a baseline configuration for their users or browsers. Customers interested in using this feature can use the link in the supplemental guidance for more information. As an administrator, you can use your Google Admin console to find details about enrolled Chrome browsers. You can review information such as enrollment dates, installed extensions, applied policies, and more. To view browser information: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Managed browsers. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Managed browsers. 3. (Optional) On the left, select an organizational unit. By default, all browsers are shown. ChromeOS Policies As a Chrome Enterprise admin, you can manage policies and settings for Chromebooks and other devices that run ChromeOS from the cloud-based Google Admin console. You can control settings that apply when people use a managed ChromeOS device, such as a Chromebook. Device-level settings apply for anyone who uses the device, even if they sign in as a guest or with a personal Gmail account. On the Device settings page, you can set policies that apply to anyone who uses a managed ChromeOS device, even if they sign in as a guest or with a personal Gmail account. Customers interested in using this feature can use the link in the supplemental guidance for more information. As an administrator, you can find details about the ChromeOS devices in your domain in the Google Admin console. To view the device list page, go to Menu and then Devices and then Chrome and then Devices. Click the serial number of any device to view device details. You can also create organizational units to apply settings to different groups of devices. 151 Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations 1. The Center for Internet Security (CIS) is a nonprofit that promotes best practices for securing IT systems and data. They publish a variety of materials including CIS Benchmarks. The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments. You can access the CIS Benchmarks for configuration of Chrome Browser and ChromeOS on the CIS website. Please refer to the supplemental guidance for a direct link. Supplemental Guidance ● Chrome Policies for Users or Browsers ● View Chrome browser details ● ChromeOS Device Policies ● View ChromeOS device list and details ● CIS Benchmarks for Google Chrome Control Domain Configuration Management Control # CM.L2-3.4.6 Control Description Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. Google Workspace Apps & Extensions Control Responsibility Enabling Features ChromeOS Device Google Policies Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Apps & Extensions ● ChromeOS Device Policies A description of each feature and implementation guidance is included below. Apps & Extensions 152 As a Chrome Enterprise admin, you can use your Admin console to apply app and extension policies across several apps at a time. These app or extension policies can apply for signed-in users on any device or enrolled browsers on Windows, Mac, or Linux. You can also control which apps or extensions users can install on managed Chrome browsers or ChromeOS devices. Customers interested in using this feature can use the links in the supplemental guidance for more information. ChromeOS Device Policies As a Chrome Enterprise admin, you should employ the principle of least functionality when configuring Chrome policies for managed Chromebooks and other ChromeOS devices and set common policies. You can manage policies and settings for Chromebooks and other devices that run ChromeOS from the cloud-based Google Admin console. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● View and configure apps and extensions ● Allow or block apps and extensions ● Managing ChromeOS device policies Control Domain Configuration Management Control # CM.L2-3.4.7 Control Description Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. Google Workspace Apps & Extensions Control Responsibility Enabling Features ChromeOS Device Google Policies Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Apps & Extensions 153 ● ChromeOS Device Policies A description of each feature and implementation guidance is included below. Apps & Extensions As a Chrome Enterprise admin, you can control which apps or extensions users can install on managed Chrome browsers or ChromeOS devices. To block or allow an app: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Apps & extensions and then Users & browsers. a. If you signed up for Chrome Browser Cloud Management, go to Menu and then Chrome browser and then Apps & extensions and then Users & browsers. 3. (Users only) To apply the setting to a group, do the following: a. Select Groups. b. Select the group to which you want to apply the setting. 4. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit. 5. Find the app that you want to configure policies for. 6. Under Installation policy, choose Block. 7. Click Save. ChromeOS Device Policies As a Chrome Enterprise admin, you should employ the principle of least functionality when configuring Chrome policies for managed Chromebooks and other ChromeOS devices and set common policies. You can manage policies and settings for Chromebooks and other devices that run ChromeOS from the cloud-based Google Admin console. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● View and configure apps and extensions ● Allow or block apps and extensions ● Managing ChromeOS device policies 154 Control Domain Configuration Management Control # CM.L2-3.4.8 Control Description Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. Google Workspace Apps & Extensions Control Responsibility Enabling Features Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Apps & Extensions A description of each feature and implementation guidance is included below. Apps & Extensions As a Chrome Enterprise admin, you can control which apps or extensions users can install on managed Chrome browsers or ChromeOS devices within the Play Store or the Chrome Web Store. 1. If you signed up for Chrome Browser Cloud Management, go to Menu and then Chrome browser and then Apps & extensions and then Users & browsers. 2. (Users only) To apply the setting to a group, do the following: a. Select Groups. b. Select the group to which you want to apply the setting. 3. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit. 4. On the right, click Additional settings. 5. Go to Allow/block mode. 6. Click Edit. 7. For Play Store apps, select one of the following options: a. Allow all apps, admin manages blocklist—Users can install all apps and extensions from the Google Play Store, except the ones that you block. b. Block all apps, admin manages allowlist—Users can only install the apps and extensions from the Google Play Store that you allow. 8. For Chrome Web Store apps, select one of the following options: a. Allow all apps, admin manages blocklist—Users can install all apps and extensions from the Chrome Web Store, except the ones that you block. 155 b. Block all apps, admin manages allowlist—Users can only install the apps and extensions from Chrome Web Store that you allow. c. Block all apps, admin manages allowlist, users may request extensions—Users can only install the apps and extensions from the Chrome Web Store that you allow, but they can also request the extensions that they need. Then, you can allow, block, or automatically install extensions that users request. See the link in the supplemental guidance for more details. 9. Click Save. Supplemental Guidance ● Allow or block apps and extensions Control Domain Configuration Management Control # CM.L2-3.4.9 Control Description Control and monitor user-installed software. Google Workspace Apps & Extensions Control Responsibility Enabling Features Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Apps & Extensions A description of each feature and implementation guidance is included below. Apps & Extensions From your Admin console, you can list all apps and extensions you've set policies for in an organizational unit. 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Apps & extensions. The Overview page opens by default. 3. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Apps & extensions. 4. At the top, click the type of app or extension you want to view: a. Users & browsers 156 b. Kiosks c. Managed guest sessions 5. On the left, choose your search: a. Users—search for apps for a specific user b. Groups—Search for apps within a specific group c. Organizational units—Search for apps within a specific organizational unit 6. At the top, click Search or add a filter and search by: a. Full-text—Enter the app or extension name or ID. b. Title—Enter the app or extension name. c. ID—Enter the app or extension ID. d. Type—Choose whether to display Android, Chrome, web apps, or IWAs. e. Installation policy—Choose whether to display apps, depending on their installation policy. 7. Click Apply. Supplemental Guidance ● Apps & Extensions Control Domain Identification & Authentication Control # IA.L1-3.5.1 Control Description Identify system users, processes acting on behalf of users, and devices. Google Workspace SAML SSO for ChromeOS Control Enabling Features devices Responsibility Google SAML SSO for Chrome apps Shared Chrome Enterprise Connectors X Customer ChromeOS Device Management Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● SAML SSO for ChromeOS devices ● SAML SSO for Chrome apps ● Chrome Enterprise Connectors ● ChromeOS Device Management A description of each feature and implementation guidance is included below. SAML SSO for ChromeOS devices 157 SAML SSO support for ChromeOS devices allows users to sign in to a device with the same authentication mechanisms that you use within the rest of your organization. Their passwords can remain within your organization's IdP. Signing in is very similar to signing in to a Google Workspace account from a browser via SAML SSO. However, because a user is signing in to a device, there are several additional considerations. Additionally, You can choose to sync ChromeOS device local passwords with users' SAML SSO passwords. By default, the local password is updated every time users sign in online. You can configure how often users are required to sign in online using the SAML single sign-on login frequency or SAML single sign-on unlock frequency settings. However, some users might change their SAML SSO password before they’re required to sign in online again. If that happens, users continue to use their old local ChromeOS password until the next time they sign in online. To keep the local ChromeOS password in sync with their SAML SSO password, you can force them to sign in online as soon as their SAML SSO password changes. That way, they update their ChromeOS password almost immediately. Customers interested in using this feature can use the link in the supplemental guidance for more information. SAML SSO for Chrome apps You can use the SAML SSO for Chrome Apps extension when you need to configure SAML SSO for Chrome apps. Users can sign in to a Chrome app with the same authentication mechanisms that you use within the rest of your organization. Their passwords can remain within your organization's IdP. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Enterprise device trust connectors As an admin, you can configure Chrome Enterprise device trust connectors to share context-aware signals from managed Chrome browsers, managed Chrome profiles and ChromeOS devices with third-party IdPs. This integration allows device trust signals as inputs in authentication and authorization policies. This solution provides enhanced security and less dependence on the network as a trust factor. Customers interested in using this feature can use the link in the supplemental guidance for more information. ChromeOS Device Management As an administrator, you can find details about the ChromeOS devices in your domain in the Google Admin console. To view the device list page: 158 1. Go to Menu and then Devices and then Chrome and then Devices. 2. Click the serial number of any device to view device details. You can also create organizational units to apply settings to different groups of devices. Supplemental Guidance ● SAML SSO for ChromeOS devices ● SAML SSO for Chrome apps ● Chrome Enterprise Connectors ● ChromeOS device management Control Domain Identification & Authentication Control # IA.L1-3.5.2 Control Description Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. Google Workspace SAML SSO for ChromeOS Control Enabling Features devices Responsibility Google SAML SSO for Chrome apps Shared Chrome Enterprise Connectors X Customer ChromeOS Device Management Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● SAML SSO for ChromeOS devices ● SAML SSO for Chrome apps ● Chrome Enterprise Connectors ● ChromeOS Device Management A description of each feature and implementation guidance is included below. Configure SAML single sign-on for ChromeOS devices SAML SSO support for ChromeOS devices allows users to sign in to a device with the same authentication mechanisms that you use within the rest of your organization. Their passwords can remain within your organization's IdP. Signing in is very similar to signing in to a Google Workspace account from a browser via SAML SSO. However, because a user is signing in to a device, there are several additional considerations. 159 Additionally, You can choose to sync ChromeOS device local passwords with users' SAML SSO passwords. By default, the local password is updated every time users sign in online. You can configure how often users are required to sign in online using the SAML single sign-on login frequency or SAML single sign-on unlock frequency settings. However, some users might change their SAML SSO password before they’re required to sign in online again. If that happens, users continue to use their old local ChromeOS password until the next time they sign in online. To keep the local ChromeOS password in sync with their SAML SSO password, you can force them to sign in online as soon as their SAML SSO password changes. That way, they update their ChromeOS password almost immediately. Customers interested in using this feature can use the link in the supplemental guidance for more information. Configure SAML single sign-on for Chrome apps You can use the SAML SSO for Chrome Apps extension when you need to configure SAML SSO for Chrome apps. Users can sign in to a Chrome app with the same authentication mechanisms that you use within the rest of your organization. Their passwords can remain within your organization's IdP. Customers interested in using this feature can use the link in the supplemental guidance for more information. Chrome Enterprise device trust connectors As an admin, you can configure Chrome Enterprise device trust connectors to share context-aware signals from managed Chrome browsers, managed Chrome profiles and ChromeOS devices with third-party IdPs. This integration allows device trust signals as inputs in authentication and authorization policies. This solution provides enhanced security and less dependence on the network as a trust factor. Customers interested in using this feature can use the link in the supplemental guidance for more information. ChromeOS Device Management As an administrator, you can find details about the ChromeOS devices in your domain in the Google Admin console. To view the device list page: 1. Go to Menu and then Devices and then Chrome and then Devices. 2. Click the serial number of any device to view device details. You can also create organizational units to apply settings to different groups of devices. Supplemental Guidance 160 ● SAML SSO for ChromeOS devices ● SAML SSO for Chrome apps ● Chrome Enterprise Connectors ● ChromeOS device management Control Domain Identification & Authentication Control # IA.L2-3.5.3 Control Description Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. Google Workspace 2–Step Verification Control Responsibility Enabling Features Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● 2-Step Verification A description of each feature and implementation guidance is included below. 2-Step Verification As a Chrome enterprise admin, you can implement 2-Step Verification (2-SV) or Multi-Factor Authentication (MFA) in your organization and force users to regularly sign in to their ChromeOS devices. This means that your users must regularly sign in to their account in two or more steps and provides additional security for your organization. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● 2-Step Verification 161 Control Domain IA.L2-3.5.11 Control # IA.L2-3.5.8 Control Description Obscure feedback of authentication information. Google Workspace Chrome Policy: Display Control Responsibility Enabling Features password button Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policy: Display password button A description of each feature and implementation guidance is included below. Chrome Policy: Display password button By default, password data is obscured in Chrome, but users may choose to select the eye icon next to the password field to reveal their password. You can change this using a Chrome policy. If you select Do not show the display password button on the login and lock screen, users don't see the icon. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome Policy: Display password button Control Domain Incident Response Control # IR.L2-3.6.1 Control Description Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. Google Workspace Chrome Enterprise Control Responsibility Enabling Features Connectors Framework Google Shared 162 X Customer Customer Implementation Description While Chrome does not natively offer any features that, if configured correctly, will address this control, the following features may support your ability to meet the control: ● Chrome Enterprise Connectors Framework A description of each feature and implementation guidance is included below. Chrome Enterprise Connectors Framework Chrome Enterprise Connectors Framework offers a collection of connectors and APIs that simplify the steps needed to integrate Chrome browser and ChromeOS with solution providers, including security providers including Splunk, Crowdstrike, and Palo Alto Networks. You can also allow third-party providers to monitor potential threats by reporting ChromeOS telemetry events. Events are sent directly from Google with no additional agents needed. As an admin, you can use the Google Admin console to get Chrome to report events to third-party service providers. For example, you can configure Chrome to report security events such as malware transfer, unsafe site visits, and password reuse. You can let Chrome report events using multiple service providers and configurations at the same time. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome Enterprise Connectors Framework Control Domain Media Protection Control # MP.L2-3.8.7 Control Description Control the use of removable media on system components. Google Workspace ChromeOS Policy: USB Control Responsibility Enabling Features Access Google Shared X Customer Customer Implementation Description 163 When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● ChromeOS Policy: USB Access A description of each feature and implementation guidance is included below. ChromeOS Policy: USB Access You can use this policy to specify a list of USB devices that can be accessed directly by apps, such as Citrix Receiver. You can list devices, such as keyboards, signature pads, printers and scanners, as well as other USB devices. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● ChromeOS Policy: USB Access Control Domain Maintenance Control # MA.L2-3.7.1 Control Description Perform maintenance on organizational systems. Google Workspace Chrome Browser Control Responsibility Enabling Features Updates Google ChromeOS Updates Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Browser Updates ● ChromeOS Updates A description of each feature and implementation guidance is included below. Chrome Browser Updates As an administrator, you can manage Chrome browser updates for users in your organization. Chrome releases a full browser update about every 6 weeks. Minor updates, such as security fixes and software updates, happen every 2–3 weeks. To keep Chrome browser secure and up to date, Google recommends using automatic updates instead of manual updates. If your 164 organization deploys Chrome browser to thousands of devices or if you have bandwidth restrictions, you might need to customize how updates are deployed. By default, Chrome browser updates to the latest version of Chrome when it is available. We recommend that you keep the default auto-update settings. That way, your users' devices will automatically update to new versions of Chrome browser as they’re released on the Stable channel. Your users will get critical security fixes and new features as they become available. To configure automatic updates: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings. The User & browser settings page opens by default. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings. 3. To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit. 4. Go to Chrome updates. 5. Click Chrome browser updates. 6. Select Allow updates. 7. Click Save. ChromeOS Updates As a Chrome administrator, you can manage ChromeOS updates for devices in your organization. Chrome releases a full OS update about every 4 weeks. Minor updates, such as security fixes and software updates, happen every 2–3 weeks. By default, ChromeOS devices update to the latest version of Chrome when it is available. Google recommends that you keep the default auto-update settings. That way, your users' devices will automatically update to new versions of ChromeOS as they’re released on the Stable channel. Your users will get critical security fixes and new features as they become available. 8. Sign in with an administrator account to the Google Admin console. 9. In the Admin console, go to Menu and then Devices and then Chrome and then Settings and then Device settings. 10. To apply the setting to all devices, leave the top organizational unit selected. Otherwise, select a child organizational unit. 11. Go to Device update settings. 12. Click Auto-update settings. 13. Select Allow updates. 14. Click Save. Supplemental Guidance ● Chrome Browser Updates 165 ● ChromeOS Updates Control Domain System & Communications Protection Control # SC.L2-3.13.4 Control Description Prevent unauthorized and unintended information transfer via shared system resources. Google Workspace Chrome Policy: Guest Control Responsibility Enabling Features Mode Google Managed Guest Sessions Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Policy: Guest Mode ● Managed Guest Sessions A description of each feature and implementation guidance is included below. Chrome Policy: Guest Mode Guest mode is a feature in Chrome that allows someone to use a Chromebook without signing in to a Google account. This policy controls guest browsing on managed ChromeOS devices. If you select Allow guest mode, the main sign-in screen offers the option for a user to sign in as a guest. If you select Disable guest mode, a user must sign in using a Google Account or Google Workspace account. When a user signs in using guest mode, your organization's policies are not applied. To disable this feature: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings and then Device settings. 3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). 4. Click Guest mode under Sign-in Settings. 5. Next to configuration, select Disable guest mode. 6. Click Save. 166 Managed Guest Sessions With managed guest sessions, multiple users can share the same device running Chrome OS without having to sign in to their Google Account. For example, use managed guest sessions to configure Chrome devices as loaner devices or shared computers. Before a device can host managed guest sessions, you must enroll the devices that you want to let users run managed guest sessions and place devices that users will use to run managed guest sessions in an organizational unit. To disable Managed Guest Sessions in Chrome devices: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings and then Managed guest sessions. 3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit. 4. Next to configuration, choose Do not allow managed guest sessions 5. Click Save. Supplemental Guidance ● Chrome Policy: Guest Mode ● Managed Guest Sessions Control Domain System & Communications Protection Control # SC.L2-3.13.6 Control Description Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). Google Workspace Chrome URL Blocklist or Allowlist Control Enabling Features Chrome Enterprise Connectors Responsibility Google Framework Shared Local and Network Printers X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome URL Blocklist or Allowlist ● Chrome Enterprise Connectors Framework ● Local and Network Printers 167 A description of each feature and implementation guidance is included below. Chrome URL Blocklist or Allowlist As a Chrome Enterprise admin, you can block and allow URLs so that users can only visit certain websites. Restricting users’ internet access can increase productivity and protect your organization from viruses and malicious content found on some websites. To configure a URL blocklist: 1. In the Admin console, go to Menu and then Devices and then Chrome and then Settings. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings. 2. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group 3. Go to Content. 4. Click URL Blocking and enter URLs as needed: a. Blocked URLs—URLs that you want to prevent users from accessing. b. Blocked URL exceptions—URLs that you want to allow users to access (allowlist). Access is allowed even if the URLs are also defined in Blocked URLs. 5. You can block and allow up to 1,000 URLs. 6. Click Save. Chrome Enterprise Connectors Framework Chrome Enterprise Connectors Framework offers a collection of connectors and APIs that simplify the steps needed to integrate Chrome browser and ChromeOS with solution providers. As an admin, you can use the Google Admin console to get Chrome to report events to third-party service providers. For example, you can configure Chrome to report security events such as malware transfer, unsafe site visits, and password reuse. You can let Chrome report events using multiple service providers and configurations at the same time. Customers interested in using this feature can use the link in the supplemental guidance for more information. Local and Network Printers As an administrator, you can use Common UNIX Printing System (CUPS) printers with your organization’s ChromeOS devices. CUPS uses an Internet Printing Protocol (IPP) to print to local and network printers. You can also track print jobs and printer usage in your organization. You can add and specify a printer for everyone, or for users or devices in certain groups or departments. 168 Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations 1. Alternatively, you can use Google Workspace to configure the networks that company-managed mobile devices, ChromeOS devices, and Google meeting room hardware use. You can control Wi-Fi, Ethernet, and Virtual Private Network (VPN) access, and set up network certificates. When you add a network configuration, you can apply the same network settings for your entire organization, or enforce specific network settings for different organizational units. Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Chrome URL Blocklist or Allowlist ● Chrome Enterprise Connectors Framework ● Network Management ● Local and Network Printers Control Domain System & Communications Protection Control # SC.L2-3.13.10 Control Description Establish and manage cryptographic keys for cryptography employed in organizational systems. Google Workspace Google Cloud Certificate Control Responsibility Enabling Features Connector Google Certificate Enrollment for Shared ChromeOS extension X Customer HTTPS Certificate Authority Certificate Enrollment for ChromeOS via SCEP Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Google Cloud Certificate Connector ● Certificate Enrollment for ChromeOS extension ● HTTPS Certificate Authority ● Certificate Enrollment for ChromeOS via SCEP 169 A description of each feature and implementation guidance is included below. Google Cloud Certificate Connector You can control user access to your organization’s Wi-Fi networks, internal apps, and internal websites on ChromeOS devices by using a connector to distribute device certificates from your on-premises Certificate Authority (CA). The Google Cloud Certificate Connector is a Windows service that securely distributes certificates and authentication keys from your Simple Certificate Enrollment Protocol (SCEP) server to users’ devices. For ChromeOS devices, private keys for certificates are generated on the device. The corresponding public key is stored temporarily on Google servers and deleted after the certificate is installed. Customers interested in using this feature can use the link in the supplemental guidance for more information. Certificate Enrollment for ChromeOS extension As an administrator you can use the Certificate Enrollment for ChromeOS extension to enable a user to get a user or device certificate either manually or automatically. You can also set up the automatic renewal of existing certificates that are expiring. Before using the extension, ensure that users have access, and that the extension and associated managed policy are properly configured. For more help with setting up the extension, see the Extension deployment guide section. Customers interested in using this feature can use the link in the supplemental guidance for more information. HTTPS Certificate Authority You will need to set up a CA to manage networks and monitor traffic for your ChromeOS devices. It’s important to set up a CA to ensure that your users can access websites that have digital certificates that can be validated by a specific CA. This should be done early during your deployment to ensure that users can access websites without issues. Customers interested in using this feature can use the link in the supplemental guidance for more information. Certificate Enrollment for ChromeOS via SCEP You may choose to set up ChromeOS Certificate Enrollment with SCEP. The Configuring Certificate Enrollment for ChromeOS via SCEP with Microsoft NDES guide is for IT administrators with Active Directory expertise who want to set up ChromeOS Certificate Enrollment with SCEP. It provides steps for configuring the Microsoft Network Device Enrollment Service (NDES) to allow enrollment and issuance of certificates used to authenticate ChromeOS devices and users to WiFi access points. 170 Customers interested in using this feature can use the link in the supplemental guidance for more information. Supplemental Guidance ● Google Cloud Certificate Connector ● Certificate Enrollment for ChromeOS extension ● HTTPS Certificate Authority ● Certificate Enrollment for ChromeOS via SCEP Control Domain System & Information Integrity Control # SI.L1-3.14.2 Control Description Provide protection from malicious code at designated locations within organizational systems. Google Workspace Chrome Safe Browsing Control Responsibility Enabling Features X Google Shared Customer Customer Implementation Description 171 When configured correctly, the following feature(s) in Google Workspace may be used to support this control: ● Chrome Safe Browsing Chrome Safe Browsing To keep your data private, Google Chrome uses Safe Browsing to protect you against: ● Abusive websites and extensions ● Malicious and intrusive ads ● Malware ● Phishing ● Social engineering Chrome Safe Browsing comes in two flavors: Standard Protection and Enhanced Protection Customers interested in using this feature can use the link in the supplemental guidance for more information. Additional Considerations 1. If you wish to use Chrome Safe Browsing to implement this control on your endpoints, you should consider restricting the browsers which are installed on those endpoints, or ensuring that all browsers installed on endpoints provide similar features. Supplemental Guidance ● Chrome Safe Browsing Control Domain System & Information Integrity Control # SI.L1-3.14.4 Control Description Update malicious code protection mechanisms when new releases are available. Google Workspace Chrome Browser Control Responsibility Enabling Features Updates Google Shared X Customer Customer Implementation Description When configured correctly, the following feature(s) in Google Workspace may be used to support this control: 172 ● Chrome Browser Updates ● ChromeOS Updates A description of each feature and implementation guidance is included below. Chrome Browser Updates As an administrator, you can manage Chrome browser updates for users in your organization. Chrome releases a full browser update about every 6 weeks. Minor updates, such as security fixes and software updates, happen every 2–3 weeks. To keep Chrome browser secure and up to date, Google recommends using automatic updates instead of manual updates. If your organization deploys Chrome browser to thousands of devices or if you have bandwidth restrictions, you might need to customize how updates are deployed. By default, Chrome browser updates to the latest version of Chrome when it’s available. We recommend that you keep the default auto-update settings. That way, your users' devices will automatically update to new versions of Chrome browser as they are released on the Stable channel. Your users will get critical security fixes and new features as they become available. To configure automatic updates: 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings. The User & browser settings page opens by default. a. If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings. 3. To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit. 4. Go to Chrome updates. 5. Click Chrome browser updates. 6. Select Allow updates. 7. Click Save. ChromeOS Updates As a Chrome administrator, you can manage ChromeOS updates for devices in your organization. Chrome releases a full OS update about every 4 weeks. Minor updates, such as security fixes and software updates, happen every 2–3 weeks. By default, ChromeOS devices update to the latest version of Chrome when it’s available. Google recommends that you keep the default auto-update settings. That way, your users' devices will automatically update to new versions of ChromeOS as they’re released on the Stable channel. Your users will get critical security fixes and new features as they become available. 1. Sign in with an administrator account to the Google Admin console. 2. In the Admin console, go to Menu and then Devices and then Chrome and then Settings and then Device settings. 173 3. To apply the setting to all devices, leave the top organizational unit selected. Otherwise, select a child organizational unit. 4. Go to Device update settings. 5. Click Auto-update settings. 6. Select Allow updates. 7. Click Save. Supplemental Guidance ● Chrome Browser Updates ● ChromeOS Updates Security audits and certifications The Cyber AB does not issue certifications for CMMC compliance for Cloud Service Providers (CSPs), but rather requires CSPs be a minimum of FedRAMP Moderate or equivalent to support customers CMMC compliance. Google Workspace is FedRAMP High compliant (see FedRAMP Marketplace), and makes other certifications, like ISO/IEC certificates and SOC audit reports, available for download via Compliance Reports Manager.1 Learn more about Google Workspace by visiting our compliance offerings website.2 Additional resources These additional resources may help you understand how Google services are designed with privacy, confidentiality, integrity, and availability of data in mind. ● Google Workspace Help Center3 ● Google Workspace security page4 ● Google Cloud Compliance Resource Center5 ● How Google Workspace uses encryption to protect your data6 This CMMC implementation guide is for informational purposes only. Google does not intend the information or recommendations in this guide to constitute legal advice. Each customer should independently evaluate its own particular use of the services as appropriate to support its legal compliance obligations. 1 https://cloud.google.com/security/compliance/compliance-reports-manager 2 https://cloud.google.com/security/compliance/offerings 3 https://support.google.com/a/ 4 https://www.google.com/work/our-approach.html 5 https://cloud.google.com/security/compliance 6 https://services.google.com/fh/files/misc/google-workspace-encryption-wp.pdf 174 Key terms, acronyms & definitions Term Definition Assured Controls Plus Assured Controls Plus for Google Workspace are specialized features that provide organizations with advanced tools and support CMMC The Cybersecurity Maturity Model Certification (CMMC) is a program which verifies that companies in the Defense Industry Base (DIB) have adequate cybersecurity safeguards in place CUI Controlled Unclassified Information (CUI) is a category of federal information that is not classified but still requires protection to ensure national security CUI Boundary The Controlled Unclassified Information (CUI) boundary is the defined organizational systems, facilities in which CUI is stored, processed, and transmitted Customer User of Google Workspace, including but not limited to: the DCMA, members of the DIB, federal contractors and subcontractors, OSAs, etc. DCMA The Defense Contract Management Agency (DCMA) is a federal agency that manages contracts for the Department of Defense and other federal agencies DFARS The Defense Federal Acquisition Regulation Supplement (DFARS) is a set of regulations that apply to a United States Department of Defense (DoD) contracts DIB The Defense Industry Base (DIB) is a network of organizations, facilities, and resources that support the United States military with services, resources, and equipment Enterprise Plus Edition Google Workspace Enterprise Plus Edition to a subscription that provides premium security and collaboration features for customers FAR The Federal Acquisition Regulation (FAR) is a set of regulations that govern how the federal govern provisions goods and services NIST The National Institute of Standards and Technology (NIST) is a United States federal agency that develops measurement 175 standards, including several cybersecurity frameworks such as NIST 800-171 and NIST 800-53. OSA Organizations seeking assessment (OSAs) are organizations aiming to comply with CMMC and/or organizations considering bidding on future Department of Defense (DoD) contracts with CMMC obligations.