ASD ISM 0261 Log web proxy activity for security analysis
What it says
The following details are centrally logged for websites accessed via web proxies: - web address - date and time - user - amount of data uploaded and downloaded - internal and external IP addresses.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRecord details of websites accessed through web proxies, including web address and user info, for security tracking.
This control is about keeping track of all the websites that people in your organisation visit using web proxies, along with details like when they visited and how much data was transferred. This is important because it helps catch any unauthorised or suspicious activities that could lead to security breaches or data leaks.
Free. Save your status, tasks and notes.
Why it matters
Without centrally logging web proxy activity, detecting unauthorised browsing or data exfiltration is delayed, increasing the likelihood and impact of a breach.
How to implement
The IT team should set up a system to log web proxy activity.
This can be done by configuring your web proxy software to automatically record details of every website visited, including the addresses, times, and associated user details.
A System Administrator should ensure the logging system captures the necessary data.
They can do this by checking that the logs include web addresses, dates and times of access, the identity of users, data transfers, and both internal and external IP addresses.
Managers should inform staff about the monitoring.
Hold a briefing session to explain that web use is logged for security reasons, and share a policy document so everyone understands acceptable use and the reasons behind these measures.
The IT team should regularly review the logs for suspicious behaviour.
Use tools or scripts to highlight unusual activity, like accessing sketchy websites or transferring large data amounts, and then investigate these further.
A Data Protection Officer should ensure log data is stored securely.
Implement access controls so that only authorised staff can view it, and ensure that logs are backed up regularly and retained for a suitable period as per your policy.
Keep it running
Centrally log proxy URL, timestamp, user, bytes in/out and internal/external IPs; alert on spikes, suspicious domains and review retention and access controls.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web proxy log configuration file.
Look at
How it's set up to ensure it captures web addresses, times, user IDs, data transfer amounts, and IP addresses.
Good evidence
Is a configuration that clearly specifies all these elements.
- Check 2 of 5What an auditor asks for
Look at
Entries that include all required data points, such as web addresses and user details.
Good evidence
Is complete, consistently formatted log entries over an extended period.
- Check 3 of 5What an auditor asks for
Ask for
How they ensure all necessary data is logged and monitored.
Good evidence
Is a clear explanation of the monitoring process and examples of how issues have been identified.
- Check 4 of 5What an auditor asks for
Good evidence
Is evidence of regular reviews and appropriate follow-up actions on identified issues.
- Check 5 of 5What an auditor asks for
Look at
How staff are informed about web usage logging and their reaction or understanding.
Good evidence
Is a simple policy document that clearly outlines logging practices and staff awareness efforts.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-0261 requires organisations to centrally log specific web proxy activity details (such as web address, timestamp, user, data volumes, and internal/external IP addresses) for websites accessed via proxies. ISO/IEC 27001:2022 Annex A 8.15 requires logs of relevant activities/events to be produced, stored, protected and analysed, encompassing a broader range of systems and life cycle requirements, while ISM-0261 applies to specific logging content for web proxy traffic.
This control supports A.8.16.
ISM-0261 requires organisations to centrally log detailed web proxy activity to provide visibility of user web access and associated network attributes. ISO/IEC 27001:2022 Annex A 8.16 focuses on monitoring networks/systems/applications for anomalous behaviour, relying on high-quality logs like those specified in ISM-0261 for detecting suspicious web activity. ISM-0261 provides necessary telemetry but does not mandate monitoring or response.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.