Most cyber attacks do not break through your front door with brute force. They get invited in through a normal web browser. I see this all the time in real-world audits. An employee clicks a link, visits a bad site, and suddenly your business is dealing with a major incident.
ISO 27001:2022 introduced Annex A 8.23 specifically to fix this problem. It is a brand new control that forces organisations to manage, restrict, and monitor access to external websites.
Quick Summary: What ISO 27001 Annex A 8.23 Requires
At a practical level, my simple rule for Annex A 8.23 is about controlling how your staff interact with the wider internet. Here is what you need to do in plain English:
- Block Dangerous Sites: Prevent staff from opening websites known for hosting malware or scams.
- Restrict Inappropriate Content: Stop users from visiting illegal, harmful, or non-work-related sites on corporate systems.
- Stop Phishing and Exploits: Stop drive-by downloads before bad software can install itself.
- Set Clear Web Rules: Give your staff clear, written guidelines on safe browsing habits.
- Train Your People: Ensure employees know how to report suspicious sites when something looks wrong.
Why ISO 27001 Annex A 8.23 Matters for Your Security
Unrestricted web access is one of the easiest ways for hackers to compromise your company. You cannot rely purely on employee judgement or basic antivirus tools. You need a dedicated web filtering control at the browser level.
Leaving your web access open exposes your business to several major risks:
- Ransomware Infections: Malicious software that locks your files and demands money.
- Stolen Passwords: Fake login pages that trick users into typing in sensitive credentials.
- Accidental Data Leaks: Employees uploading confidential business files to unapproved online sites.
- Botnet Hijacking: Hidden code allowing hackers to control your devices remotely.
My 10 Step Plan to Implement Annex A 8.23 Fast
You do not need to overcomplicate this control. Here is the exact, pragmatic process I recommend to get compliant without slowing down your business.
1. Categorise Web Domains
Decide which types of websites your team needs and which types must be blocked. Your block list should always cover:
- Known malware domains and malicious links.
- Hacking forums and illegal content hubs.
- Unapproved file storage sites that allow data uploads.
- Websites that conflict with your workplace policies.
2. Block High Risk Access Automatically
Do not wait for an incident to happen. Use automated web filters to stop users from hitting dangerous domains instantly.
- Hook your filter into live threat intelligence feeds.
- Block fake domains that impersonate major banks or services.
- Stop users from reaching known phishing pages.
3. Lock Down File Upload Capability
Data leakage often happens because staff upload company documents to consumer cloud services. Control this risk directly:
- Block unauthorized file transfer websites completely.
- Require explicit business approval for new cloud storage tools.
- Limit upload rights strictly to staff who genuinely need them.
4. Deploy Modern Filtering Tools
Use a combination of smart technical tools so you do not block legitimate business work by mistake. Combine these methods:
- URL category filtering.
- Domain and IP address blocking.
- Behavioral analysis tools that catch brand new threats.
- Simple allow lists and block lists.
5. Protect Remote and Hybrid Workers
Your web controls must work everywhere, not just inside your main office building. Make sure your filtering covers:
- Laptops used by remote staff at home.
- Mobile phones connected to corporate email.
- Cloud environments used by your team.
6. Keep Your Rules Up to Date
Cyber threats change every single day. A static block list will fail very quickly. Build a simple review routine:
- Check your blocked site categories every quarter.
- Update your filters whenever new threat data comes out.
- Adjust your rules as your business grows.
7. Use Live Threat Intelligence
Do not try to find bad websites by hand. Connect your web filter to automated security systems that track malicious links worldwide.
- Subscribe to trusted threat feeds.
- Enable automatic rule updates in your firewalls or software.
- Respond instantly when new threat categories appear.
8. Train Your Staff on Web Safety
Technology handles most of the heavy lifting, but your staff are still a crucial line of defence. Ensure your team receives simple training on:
- Why certain website categories are blocked.
- How to spot browser warnings about unsecure sites.
- How to report strange links safely to your security lead.
9. Setup an Approval Process for Exceptions
Sometimes an employee has a legitimate business need to view a restricted site. Never leave this unmonitored. Handle it with a simple process:
- Require a formal written request for site unblocking.
- Set an automatic expiration date on all access approvals.
- Log and review all approved site exceptions.
10. Check Your Web Logs Regularly
You cannot improve what you do not measure. Review your system reports to confirm your controls are working properly:
- Look at top blocked website categories each month.
- Identify repeat policy breaches or risky user habits.
- Fine-tune your filtering rules based on real data.
Common Implementation Pitfalls to Avoid
When I help businesses prepare for ISO 27001 certification, I frequently see the same mistakes with web filtering. Here are the main traps and how to solve them:
- Problem: Being Too Permissive
Ninja Solution: Block bad content categories by default using threat intelligence. - Problem: Users Trying to Bypass Controls
Ninja Solution: Pair technical web blocks with clear training and routine log reviews. - Problem: Outdated Rule Sets
Ninja Solution: Put a recurring reminder on your calendar to review filtering rules. - Problem: No Clear Exception Process
Ninja Solution: Set up a fast, single-page form for temporary site access requests.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.23 is not about locking down the entire internet or stopping your staff from doing their job. It is about removing obvious, unnecessary risks from your primary attack surface.
You cannot control what happens across the global internet. But you can easily control how your business connects to it. Implementing web filtering properly gives you control, audit compliance, and immediate peace of mind.