ISO 27001 A.8.23: web filtering, explained for startups

A.8.23 Web filtering

Staff devices are blocked from known harmful websites. What proves it: filtering that blocks known harmful websites on staff devices.

A certification auditor samples web or domain filtering settings. A file that usually does the job: settings from a filtering service or endpoint protection that blocks malicious and phishing sites.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.8.23 walks you through it in this order.

1. Turn on web protection in your endpoint tool, or use a filtering service.
2. Block known malicious and phishing categories.
3. Check that it covers remote devices too.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do company devices block known malicious websites?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Network Security Policy covers A.8.23. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC6.8, malware prevention.

Technological controls

A.8.23 is one of the 34 technological controls in Annex A. The controls built into your systems: access, devices, malware, vulnerabilities, backups, logging, networks, encryption and secure development. Exports and settings screenshots prove most of them.

Nearby controls in the same theme:

• A.8.20, network security
• A.8.21, network services
• A.8.22, network segregation
• A.8.24, encryption
• A.8.25, secure development
• A.8.26, application security needs

Before it: A.8.22, network segregation. After it: A.8.24, encryption. Every control, by theme, is on the Annex A controls page.