ISO 27001 A.8.23 - Web Filtering

Requirement

“Access to external websites shall be managed to reduce exposure to malicious content.”

Plain-language meaning

Users can be compromised by visiting malicious websites, downloading fake tools, following phishing links, or connecting to command-and-control infrastructure. Web filtering reduces this exposure by blocking or warning on risky website categories, known malicious domains, and policy-violating destinations.

Web filtering does not replace user awareness. It adds a technical layer because people still make mistakes.

Why this matters

Malicious websites are common delivery paths for malware, credential theft, fake antivirus scams, browser exploits, drive-by downloads, and command-and-control traffic. Web filtering can prevent access, alert on suspicious attempts, and feed monitoring or incident response.

The hard part is balance. Overblocking damages business activity. Underblocking leaves users exposed.

Implementation guidance

1. Define web filtering policy

Decide which website categories are blocked, warned, allowed, or monitored. Base the decision on risk assessment, legal requirements, acceptable use, business need, and user group sensitivity.

2. Apply filtering to in-scope systems

Filtering may be endpoint-based, network-based, DNS-based, proxy-based, cloud secure web gateway-based, or a combination. The organization should understand which users, devices, locations, and remote-working scenarios are covered.

3. Manage uncategorized and false-positive sites

Define what happens when a site has no category, is incorrectly blocked, or needs business exception. Exceptions should be authorized, time-bound where appropriate, and reviewed.

4. Prevent bypass

Users should not be able to disable or bypass filtering casually. Bypass attempts should be logged or alerted where practical.

5. Connect high-risk events to monitoring

Attempts to access known malicious sites, command-and-control destinations, phishing infrastructure, or malware delivery sites may indicate compromise and should feed A.8.16 Monitoring Activities and incident handling.

Audit guidance

Auditors should verify:

• web filtering policy is defined and risk-based;
• filtering is applied consistently to in-scope systems;
• remote users and mobile devices are covered where required;
• blocked categories match policy;
• exceptions and false positives are authorized and reviewed;
• users cannot manually bypass or disable filtering without approval;
• attempts to reach known malicious or command-and-control destinations generate alerts where practical;
• filtering effectiveness is reviewed;
• staff understand what filtering exists and why.

Evidence examples

Strong evidence

• Filtering categories are mapped to policy and risk.
• Coverage includes endpoints, remote users, and relevant network paths.
• Exceptions have owner, reason, approval, and review date.
• Bypass attempts are blocked or alerted.
• Malicious destination attempts feed monitoring or incident handling.
• Reviews consider both security effectiveness and business impact.

Weak evidence

• Filtering tool exists but scope is unclear.
• Categories are vendor defaults with no policy mapping.
• Exceptions are permanent and ownerless.
• Remote users bypass filtering.
• Users can disable the agent.
• Alerts are collected but not reviewed.
• Legitimate business sites are blocked with no exception process.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.7 Protection Against Malware
• A.8.12 Data Leakage Prevention
• A.8.16 Monitoring Activities
• A.8.20 Networks Security
• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.6.3 Information Security Awareness Education and Training
• A.5.25 Assessment and Decision on Information Security Events
• A.5.26 Response to Information Security Incidents
• Risk Assessment
• Statement of Applicability
• Web Filtering Policy and Category Matrix
• Web Filtering Exception Register
• Web Filtering Coverage Review
• A.8.23 Audit Evidence Pack
• A.8.23 Audit Checklist

KB-ready summary

• Define blocked, warned, allowed, and monitored categories.
• Apply filtering consistently to in-scope users and devices.
• Manage exceptions and false positives.
• Prevent casual bypass.
• Feed malicious destination attempts into monitoring and incident handling.

Templates and checklists

• Web Filtering Policy and Category Matrix
• Web Filtering Exception Register
• Web Filtering Coverage Review
• A.8.23 Audit Checklist