Want to fast track your ISO 27001 journey? 

Our “ISO 27001:2022 Policy Pack” gives you everything you need to comply with this, and all ISO 27001 requirements. Take a look, and when you buy it, you also receive our “Real Easy Guide To ISO27001” book (available on Amazon).

Introduction to ISO 27001 – A8.23

What does ISO 27001 – A8.23 require?

For this ISO27001 control, the auditor will expect to see a variety of security measures that might include; 

• Acceptable Use Policies (A5.10 – Acceptable use of information and other associated assets)
• Access Control policies and procedures (A5.15 – Access Control)
• Web filtering and content blocking technology has been implemented

• Processes to manage ICT Suppliers (A5.21 – Managing information security in the ICT supply chain)
• Logging of activity on the network (A8.15 – Logging)
• Monitoring of activities on the network (A8.16 – Monitoring Activities)
• Malware protection (A8.7 – Protection against malware)
• Monitoring of activities on the network (A8.16 – Monitoring Activities)
• Audit results.Incident Logs.
• Incident Logs
• Disciplinary processes (A6.4 – Disciplinary process)
• Awareness, Education and Training (A6.3 – Information security awareness, education and training)

What do you need to do?

Speak to your IT team to establish what forms of web filtering are in place. Speak to your IT team to find out what approach they have used for web filtering, as it can be implemented at different levels, including device, browser, or network level. Typical approaches include; 

• Proxy-Based Filtering – Filtered using proxy services which restrict access to sites.
• URL Filtering – Using established lists of banned URLs.
• Keyword Filtering – Restricting access based on specific keywords.
• DNS-Based Filtering – Limiting access to specific websites based on their Doman name.
• Content Filtering – Scanning of websites for content which might be deemed unacceptable.

 Establish how rules have been defined, and identify any risks associated to this process. Who decided what is and is not permissible?  This also includes when sites can be accessed. 

 For example, you might determine that shopping sites are ok (e.g. Amazon.co.uk), but not between the hours of 9am and 12pm, and 2pm to 5pm.  This means that when people can still access these sites, but only during breaks, or after work.

The parameters you define are personal to your organisation, because different organisations will have different requirements.

For example, we worked with a law enforcement agency that investigated drugs. Terms used to describe drugs often change, and understanding what is available requires an understanding of what the drugs are, and what they do.  Therefore, the web filtering tools needed to allow searches to, and for all classes of drugs.  If web filtering tools had been too restrictive, then they couldn’t do their job.  Access to the sites they were using would be blocked in most organizations, but they allowed it based on need and risk.

Ensure you have an acceptable use policy in place which outlines what you deem to be acceptable use of the internet. For example you might outline that shopping is acceptable, but only between certain hours (as described above). Once this is in place you need to ensure personnel and other interested parties are aware of what your policy is. Include this within your training and awareness process, so that people understand why you have taken the actions you have taken.

Difficulty rating

We rate this a 1.5 out of 5 difficulty rating. Initially, this is a very IT focused control, and requires significant input from your IT function, so that you understand what web filtering tools are available to you. But you will need to agree web filtering rules with the business, as functions may have different access requirements.

Q&A

Do I need a policy?

No, you don’t need a topic-specific policy for web filtering, but you should outline what web filtering is in place and what you expect in your Acceptable Use Policy.

What if there is no web filtering in place?

Don’t leave this to chance. Web filtering is extremely important for all the reasons already stated above. You are protecting your people and your business from malicious content being accessed, and you are ensuring your people are being as productive as possible.

We are ISO 27001 Consultants who provide ‘Compliance without Complexity’® and we know we can help you… we even wrote a book about it. For more information on how to implement ISO 27001, written by ISO 27001 consultants like us, you should buy our book “The Real Easy Guide to ISO27001” which is available on Amazon.

Fastback your journey to ISO27001 and buy our Policies to get started TODAY!

Take a look at our “ISO 27001:2022 Policy Pack” and when coupled with our book you’ll have everything you need to succeed in achieving ISO 27001 certification!