In this ultimate how to implement guide to ISO 27001 Annex A 8.23 Web Filtering, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
1. Define Your Rules (The Policy)
Before you buy any software, you need to decide what “safe” looks like for your business. This usually feeds into your Acceptable Use Policy. You need to categorise websites into three buckets:
- Allowed: Sites necessary for business (e.g., Office 365, LinkedIn, industry news).
- Blocked (Security): Sites known for malware, phishing, command-and-control botnets, and illegal content. These should be non-negotiable.
- Blocked (Policy): Sites that aren’t dangerous but are unwanted (e.g., gambling, adult content, or excessive streaming services).
2. Choose the Right Technology
How you implement this depends on your size. According to the experts at Hightable.io, small businesses might rely on the filtering built into their endpoint antivirus software or standard browser protections. Larger enterprises, however, usually need a centralised solution—such as a DNS filter (like Cisco Umbrella or Cloudflare) or a dedicated Secure Web Gateway (SWG).
The key is consistency. Your web filter should work whether the employee is sitting in the head office or working from a coffee shop on a laptop.
3. Handle Encryption (HTTPS)
Most of the web is now encrypted (HTTPS), which is great for privacy but tricky for filtering. Basic filters can only see the domain name (e.g., “facebook.com”), not the specific page. Advanced filters perform “SSL Inspection” to look inside the traffic, but this introduces privacy concerns and complexity.
For most ISO 27001 implementations, domain-level filtering is sufficient. You block the bad neighbourhoods of the internet so you don’t have to police every house.
4. The Exception Process
This is where many audits fail. You must have a process for when the filter gets it wrong. If a marketing manager needs to access a gambling site for market research, or if a legitimate business tool is wrongly categorised as “malware,” how do they get access?
You need a documented “Exception Process.” Users should be able to request access, and a specific person (like the IT Manager or CISO) should review and approve it based on risk. Keep a log of these exceptions—your auditor will want to see it.
Common Challenges and Solutions
Over-Blocking: If you block too much, employees will find ways around it (like using personal phones or VPNs), creating “Shadow IT” risks. Solution: Start with a “lenient” policy that only blocks high-risk security threats. Monitor the logs for a few weeks to see what people are accessing before you start blocking productivity categories.
Remote Workers: A firewall in the office doesn’t help a remote worker. Solution: Use agent-based filtering that lives on the laptop, or cloud-based DNS filtering that protects the device regardless of which network it connects to.
A Quick Checklist
To ensure you are compliant, verify these points:
- Do you have a policy stating which types of websites are prohibited?
- Is a web filtering tool active on all corporate devices?
- Are illegal and malicious sites blocked by default?
- Is there a documented process for users to request access to blocked sites?
- Do you review the filtering logs periodically to identify new threats or policy violations?
- Are staff trained on why these blocks exist (so they don’t try to bypass them)?
About the author
