ISO 27001:2022 Annex A 8.23 – Web Filtering Explained

Most malware doesn’t break in.
It’s invited in through a browser.

Annex A 8.23 exists to ensure organisations restrict and control access to external websites, reducing the likelihood of malware infection, phishing, data leakage, and exposure to illegal or inappropriate content.

This control is about reducing exposure at the point users interact with the internet.

Quick Guide: Annex A 8.23 at a Glance

Annex A 8.23 of ISO 27001:2022 focuses on web filtering.

At a practical level, this means:

Restricting access to high-risk or inappropriate websites
Preventing access to known malicious content
Reducing exposure to phishing and drive-by downloads
Applying rules for safe and appropriate web use
Supporting user awareness and reporting

This is a new control in ISO 27001:2022, reflecting how frequently browsers are used as an attack vector.

In-Depth Guide to Annex A 8.23

What Is Annex A 8.23 and Why Does It Matter?

Web access is one of the most common causes of:

Malware infection
Credential compromise
Ransomware incidents
Data leakage

Common attack scenarios include:

Phishing emails directing users to malicious websites
Drive-by downloads that install malware automatically
Users accessing unsafe or illegal content
Command-and-control communication via compromised websites

Annex A 8.23 ensures organisations reduce risk by controlling where users are allowed to browse, rather than relying solely on user judgement or endpoint protection.

How to Implement Annex A 8.23 Effectively

A pragmatic approach to Annex A 8.23 typically includes the following elements.

1. Define Acceptable and Prohibited Website Categories

Organisations should determine which types of websites:

Are acceptable for business use
Should be restricted or blocked

This may include blocking:

Known or suspected malicious websites
Sites identified through threat intelligence
Command-and-control servers
Websites distributing illegal content
Websites inappropriate for the working environment

Rules should be clear, documented, and aligned with acceptable use policies.

2. Restrict Access to High-Risk Websites

Web filtering controls should prevent access to:

Websites known to host malware
Domains associated with phishing activity
Sites flagged by security intelligence feeds

Blocking access reduces the likelihood of:

Drive-by downloads
Malware installation
Credential harvesting

Prevention is significantly more effective than clean-up.

3. Control Websites That Allow Uploading of Information

Annex A 8.23 explicitly highlights websites that enable data upload.

Organisations should:

Restrict access to upload-capable websites
Require authorisation where business need exists
Apply additional controls where uploads are permitted

Unrestricted uploads increase the risk of:

Data leakage
Unauthorised sharing
Regulatory breach

4. Apply Web Filtering Using Appropriate Techniques

ISO 27001:2022 recognises multiple web filtering approaches, including:

Domain or IP blocking
URL categorisation
Signature-based detection
Heuristics and behavioural analysis
Allow lists and block lists

Organisations may combine techniques to improve accuracy and reduce false positives.

5. Ensure Web Filtering Applies Across Relevant Environments

Web filtering should be considered for:

Corporate networks
Remote and mobile users
Cloud-based environments

Controls should remain effective regardless of user location.

6. Review and Update Filtering Rules Regularly

Threats change continuously.

Organisations should:

Review blocked and allowed categories
Update rules based on emerging threats
Adjust controls as business needs change

Static filtering rules degrade quickly.

7. Align Web Filtering With Threat Intelligence

Annex A 8.23 explicitly supports use of threat intelligence.

Organisations should:

Use trusted threat intelligence sources
Update filtering rules automatically where possible
Respond quickly to new malicious domains

Threat-led filtering improves relevance and effectiveness.

8. Provide User Awareness and Training

Web filtering is not sufficient on its own.

Organisations should ensure users:

Understand why certain websites are blocked
Know how to report suspicious websites
Recognise browser security warnings

Training should also cover:

The exception process for legitimate business access
How to respond to browser warnings about insecure sites

People remain a key control point.

9. Define and Manage Exceptions

Where access to restricted websites is required:

Exceptions should be approved
Access should be time-limited
Use should be monitored where appropriate

Exceptions without control undermine the effectiveness of filtering.

10. Monitor and Review Web Filtering Effectiveness

Organisations should periodically review:

Web filtering logs
Attempted access to blocked sites
Trends indicating user behaviour or emerging risk

Monitoring supports continuous improvement and assurance.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.23 does not require:

Blocking all internet access
Preventing legitimate research or operational activity
Treating users as untrusted by default

It does require organisations to:

Reduce unnecessary exposure
Prevent access to known high-risk content
Be able to justify filtering decisions

Most web-based attacks succeed because access was never restricted in the first place.

Common Challenges and How to Overcome Them

Overly permissive web access
Apply risk-based filtering aligned with threat intelligence

Users bypassing controls
Combine filtering with awareness and monitoring

Filtering rules never reviewed
Perform regular rule and category reviews

Unclear exception handling
Define approval and review processes

Web filtering fails when it is treated as optional.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.23 is about reducing the attack surface presented by the browser.

When web filtering is implemented effectively:

Malware infections are reduced
Phishing success rates decrease
Data leakage risk is controlled
User behaviour aligns more closely with policy

You cannot control the internet.
But you can control how your organisation interacts with it.

Annex A 8.23 ensures organisations do exactly that.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.23 – Web Filtering Explained

Quick Guide: Annex A 8.23 at a Glance

In-Depth Guide to Annex A 8.23

What Is Annex A 8.23 and Why Does It Matter?

How to Implement Annex A 8.23 Effectively

1. Define Acceptable and Prohibited Website Categories

2. Restrict Access to High-Risk Websites

3. Control Websites That Allow Uploading of Information

4. Apply Web Filtering Using Appropriate Techniques

5. Ensure Web Filtering Applies Across Relevant Environments

6. Review and Update Filtering Rules Regularly

7. Align Web Filtering With Threat Intelligence

8. Provide User Awareness and Training

9. Define and Manage Exceptions

10. Monitor and Review Web Filtering Effectiveness

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!