ASD ISM 0258 Establish and maintain a web usage policy
What it says
A web usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDevelop and maintain a policy to manage how the web is used and accessed.
A web usage policy is about setting clear rules for how employees can use the internet at work. This is important because without guidelines, people might visit unsafe websites, leading to potential security threats like viruses or data breaches, which can harm the business and its reputation.
Free. Save your status, tasks and notes.
Why it matters
Without a web usage policy, staff may visit unsafe sites, increasing malware, credential theft and data leakage risk, and causing reputational damage.
How to implement
The business owner should draft a basic web usage policy outlining acceptable internet behaviour at work.
Start by listing sites and activities that are beneficial for work and those that pose risks, like downloading pirated software.
Have the HR manager introduce the web usage policy to all staff.
Hold a short training session to explain the policy's importance and answer any questions employees might have.
IT personnel should configure web filters to block access to inappropriate or dangerous websites.
Use software that automatically prevents access to these sites and monitor activity to ensure compliance.
Managers should periodically review web usage reports.
They can check these reports provided by IT to ensure employees are adhering to the policy and discuss any issues with staff members involved.
Regularly update the policy to adapt to new risks and technologies.
The policy should be reviewed annually by the business owner in consultation with IT to reflect changes in the internet landscape.
Keep it running
Review the web usage policy at least annually and after major incidents; brief staff on acceptable browsing and prohibited sites, and align it to current web threats.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written web usage policy document.
Look at
How clearly it outlines acceptable and unacceptable internet activities.
Good evidence
Will be a comprehensive document with clear rules and consequences for misconduct.
- Check 2 of 5What an auditor asks for
Good evidence
Result means the software is active and regularly updated to block new threats.
- Check 3 of 5What an auditor asks for
Good evidence
Is when employees know the main do's and don'ts without ambiguity.
- Check 4 of 5What an auditor asks for
Look at
The reports generated by IT for unusual activity.
Good evidence
Is the creation of regular and insightful reports highlighting adherence or violations.
- Check 5 of 5What an auditor asks for
Good evidence
Outcome is clear documentation of actions taken and resolved incidents.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
Annex A 5.10 requires organisations to identify, document and implement rules for acceptable use and handling of information and associated assets. ISM-0258 fits within this by mandating a specific acceptable-use policy for web browsing and related information handling behaviours. ISM-0258 is narrower in scope (web usage only), while Annex A 5.10 covers acceptable use across all information assets and usage contexts.
This control partially overlaps A.5.15.
ISM-0258 requires organisations to develop, implement and maintain a web usage policy governing web access and use. Annex A 5.15 requires establishing and implementing access control policies and procedures for logical (and physical) access based on business and security requirements, which can include rules for web access. ISM-0258 is topic-specific to web usage, while Annex A 5.15 is broader and covers access control across all information assets and access methods, not just web browsing.
This control depends on A.8.23.
Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-0258 requires establishing a web usage policy, which supports Annex A 8.23 by defining acceptable use and responsibilities that inform filtering decisions. ISM-0258 is governance-focused, not implementing technical access management.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.