Control A.8.23Web filtering
Access to external websites must be managed to reduce exposure to malicious content.
New in the 2022 edition, and it addresses one of the two paths by which most malicious content arrives — the other being email.
Management may mean blocking categories known to be dangerous, blocking known-malicious destinations, inspecting content, or isolating browsing from the endpoint. The technique follows the risk; what the control requires is that the exposure is managed rather than left open.
The tension is with legitimate work. Over-blocking generates exception requests, and the exceptions are granted by people under pressure to unblock something, which is how category lists degrade. It also pushes people onto personal devices for work tasks, which moves the activity somewhere the organisation cannot see at all.
Filtering is a reduction, not a barrier. Malicious content arriving from reputable and newly registered domains passes category-based controls, which is why this sits alongside A.8.7’s malware protection rather than instead of it.
How to put this in place
People browse from everywhere, and malicious sites are a common route for malware and phishing. Your ISMS needs web access filtering that follows the user, not only the office network.
- Decide the categories to block and the policy behind them.
- Choose a way to filter that covers remote workers, through the endpoint or a cloud service.
- Block known malicious sites and review the block reports.
- Define an exception route with approval.
- Check coverage against your device inventory.
Evidence an auditor usually looks for: web filtering configuration and coverage, and block reports.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.