A.8.23 Audit Checklist

When to use this

Use this checklist during an internal audit of web filtering policy, tool configuration, coverage, exceptions, bypass resistance, monitoring, and awareness.

Related controls

• A.8.23 Web Filtering
• A.8.23 Audit Evidence Pack
• Web Filtering Policy and Category Matrix
• Web Filtering Exception Register
• Web Filtering Coverage Review

Audit checklist

• Review web filtering policy.
• Compare policy to category/rule configuration.
• Review coverage for users, devices, and remote access.
• Review exception and false-positive handling.
• Verify users cannot manually bypass filtering.
• Review alerts for malicious or command-and-control destinations.
• Check alert escalation into monitoring or incident response.
• Review periodic effectiveness reviews.
• Interview users on what filtering exists and why.

Findings table