ISO 27001:2022 · Technological controls
ISO 27001:2022 8.23: Web filtering
ISO 27001:2022 8.23 covers Web filtering. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.8.23, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Filtering applies only on the office network, not to remote workers.
The organization is to manage which external websites can be reached, so that exposure to malicious content falls. Purpose (stated in ISO/IEC 27002:2022): keeps malware off systems and blocks unauthorized web resources. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.23.
What evidence supports 8.23?
- Annex A technological controlStatement of Applicability entry for control A.8.23, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A technological controlCurrent rules on safe, proper use of online resources
- Annex A technological controlWeb filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
- Annex A technological controlIntegration of threat intelligence feeds into block lists
- Annex A technological controlThe exception request and approval process with records of approved exceptions
Where this requirement comes from
This is our own statement of ISO 27001:2022 8.23, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Filtering applies only on the office network, not to remote workers
- Upload and file-sharing sites are open to all users without a business reason
- Users routinely click through browser security warnings
- Block lists are static and not updated from threat intelligence
How it maps to SOC 2
- CC6.6 high Web filtering blocks external threats delivered through browsing.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.