Web filtering

Plain-language summary

New in 2022: managing which external websites people can reach from your devices, so that known malicious, phishing and high-risk sites are blocked before a click turns into an infection — on the office network, on laptops working from home and on managed phones.

What the clause is really asking

The web is a main delivery route for malware and credential theft; this new control asks you to manage access to external websites to reduce exposure. That means deciding which categories of site to block (known malware and phishing, newly registered domains, anonymisers, illegal content), enforcing them through DNS filtering, a secure web gateway or browser controls, and telling people the rules and the exception route. The threat has moved: the Microsoft Digital Defense Report 2025 found that ClickFix-style lures — a fake page telling the user to paste a command to 'fix' their browser or prove they are human — made up a large share of the initial access it observed. Filtering blocks the lure pages and payload hosts it knows about; awareness and endpoint controls must catch the rest. QR-code phishing moves the click onto a phone, outside the office filter, so coverage has to follow the device. The common misunderstanding is that this is about blocking social media; it is about malicious content, and filtering that stops at the office firewall misses every remote worker.

What auditors look for

Auditors ask for the web filtering rules and the categories you block, then check the configuration in the filtering tool. They test it: from a sample laptop on the office network and, where they can, off the network on a hotspot, they try a blocked category or a vendor-provided test URL. Given QR-code phishing, they ask whether managed phones are filtered. They pull the block reports and ask who reviews them and what happened after the last malicious-site hit. They ask how users request access to a wrongly blocked site and who approves it. The hard question: does the filtering still apply when the laptop leaves the building?

Typical evidence

Web filtering rules within the acceptable use or a topic-specific policy; blocked category list and configuration screenshots; coverage evidence for office, remote and mobile devices; block and threat reports with review records; exception requests and approvals; test results from on and off the network; awareness material covering ClickFix and QR-code phishing; threat feed update settings.

How to comply — recommendations

Add a short section to your acceptable use policy saying which categories are blocked and why, and how to ask for an exception. Implement DNS-layer or agent-based filtering that follows the laptop off the network, not only a filter on the office firewall, and extend it to managed phones through your mobile device management. Block at least malware, phishing, newly registered and uncategorised domains, and anonymising proxies. Review the block report monthly — a spike of phishing hits for one user is an incident lead. Brief staff on the two current lures: any page asking them to paste or run a command, and QR codes in emails or on posters asking them to sign in. Test off-network coverage quarterly.

Common nonconformities

No web filtering, or no defined blocked categories; filtering only on the office network while staff work remotely; mobile devices not covered; block reports never reviewed; exceptions granted informally with no record; filtering rules not communicated to users; filtering subscription or threat feed lapsed; policy concerned only with productivity, not malicious sites.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.