Key takeaways
- Control access to external websites to reduce exposure to malicious content.
- Filtering web access reduces exposure to malicious sites and downloads.
- Start here: block known malicious and high-risk site categories.
Purpose
Control access to external websites to reduce exposure to malicious content.
Requirement
Requirement summaryAccess to external websites shall be managed to reduce exposure to malicious content.
Why it matters
Filtering web access reduces exposure to malicious sites and downloads.
How to implement
- Block known malicious and high-risk site categories.
- Apply filtering to remote devices too.
- Allow exceptions through approval.
- Review filtering logs for patterns.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.23. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your web filtering rules: which types of websites are blocked.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.23 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Filtering settings and blocked categories.
- Records of blocked attempts.
- Approval records for any exceptions.
- Reviews of the blocked list.
Things you should be able to show or explain
- Be able to show a blocked website warning.
How much to show: Your current filtering settings.
Common mistakes
- No web filtering.
- Exceptions given without approval.
- Filtering only on the office network.
- No process for exceptions.
- Tip: Block known-malicious categories via DNS filtering.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.23 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.23?
Be ready to explain how the control works in your organisation and to provide things like: Your web filtering rules: which types of websites are blocked…