ASD ISM 0260 Ensure all web access uses proxies
What it says
All web access, including that by internal servers, is conducted through web proxies.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll web access must go through web proxies to control and monitor internet use.
This control means that whenever you or your servers access the internet, they should go through a web proxy. Think of a proxy as a filter that checks what is being accessed online. If this isn't done, risky websites could be accessed without any checks, which might lead to security breaches or improper use of company data.
Free. Save your status, tasks and notes.
Why it matters
Without enforced web proxy use, users and servers may browse directly to malicious sites, bypass filtering/logging, and enable malware or data loss.
How to implement
The IT team should configure all internet connections through a web proxy.
They can do this by setting up a central proxy server that all devices must use to access the web. This ensures every request to visit a website is checked and logged.
Business managers should ensure awareness of this policy among employees.
They can host a meeting explaining why internet access is filtered and how it protects both the organisation and its employees from online threats.
System administrators should regularly update the proxy server rules.
They can achieve this by reviewing available updates to the proxy software and applying necessary updates to keep the system secure.
Procurement should ensure any new systems or servers adhere to this requirement.
They should include the use of web proxies as a mandatory requirement in any purchase of systems that access the internet.
The IT manager should conduct regular training sessions for network and system users.
Training should cover the reasons for using proxies, how they work, and what users should expect in terms of web access and monitoring.
Keep it running
Monitor proxy logs for anomalies, validate all egress web traffic (including servers) is forced through the proxy, and block direct Internet access at firewalls.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The internet usage policy: This document should state that all traffic goes through a web proxy.
Look at
A section detailing how and why the policy is enforced.
Good evidence
Is clear criteria and steps that meet this requirement.
- Check 2 of 5What an auditor asks for
Look at
Specific configuration entries that dictate proxy use.
Good evidence
Is complete settings showing all internet traffic is covered.
- Check 3 of 5What an auditor asks for
Ask for
How they configure and maintain the proxy server.
Good evidence
Is staff confidently explaining ongoing management and the benefits of using proxies.
- Check 4 of 5What an auditor asks for
Good evidence
Is the seamless but secure connection after proxy verification.
- Check 5 of 5What an auditor asks for
Look at
Entries to confirm they include times, user details, and block/allow actions.
Good evidence
Provides evidence of regular checked and updated logs.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
ISM-0260 requires that all web access, including from internal servers, be routed through web proxies for control and monitoring. Annex A 8.23 requires management of external website access to reduce exposure to malicious content, often implemented using proxy-based web filtering. ISM-0260 provides the technical means (proxies) for consistent filtering and logging, while Annex A 8.23 focuses on outcomes and could alternatively use DNS filtering or endpoint controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.