Skip to content
Email
ASD ISMISM-0267

ASD ISM 0267 Blocking access to unapproved webmail services

What it says

Access to non-approved webmail services is blocked.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Prevent access to webmail services that haven't been approved by the organisation.

This control is about stopping people in your business from using email services that your organisation hasn't approved. It matters because using unapproved email services can increase the risk of sensitive information leaking out, which can lead to data breaches and damage to your organisation's reputation.

Why it matters

Unapproved webmail can expose sensitive data to unauthorised entities, leading to data breaches and reputational damage.

How to implement

  1. The IT team should identify all webmail services that staff are using by checking internet logs or asking staff.

    Make a list of these services and highlight the ones that are not approved.

  2. The IT manager should decide which webmail services are safe and suitable for your organisation.

    This involves checking each service's security features and your organisation's needs.

  3. The IT team must configure your network firewall or internet filters to block access to unapproved webmail sites.

    This can be done by adding the specific webmail URLs to a block list in these devices.

  4. Managers should inform staff about the decision to block these services and explain why it is important.

    This communication should be clear and provide alternatives that have been approved for use.

  5. The IT staff should regularly check for any attempts to access blocked webmail services.

    This can be done by monitoring network logs for any suspicious activity and ensuring that the blocking measures remain effective.

Keep it running

Maintain an approved webmail allowlist and enforce blocks via proxy/DNS/firewall; review logs regularly and update rules as services change.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of approved webmail services: Request the document or email where the approved services are listed.

    Look at

    The list for clarity and organisational approval.

    Good evidence

    Shows a defined list with a clear approval date and authorisation.

  2. Check 2 of 5What an auditor asks for

    Ask for

    A demonstration of the configuration.

    Look at

    The specific URLs or webmail services listed as blocked.

    Good evidence

    Shows the targeted URLs aligned with the unapproved list and that blocking is active.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Them to explain how webmail services are selected for approval.

    Good evidence

    Includes criteria for approval, who is involved in the decision, and how often this is reviewed.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see how attempts to access blocked services are detected.

    Look at

    Evidence of real-time alerts or records of block attempts.

    Good evidence

    Shows clear and working detection mechanisms.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Emails or memos regarding the blocking policy.

    Look at

    How the rationale and alternatives are communicated.

    Good evidence

    Includes positive staff feedback and clear instructions on what to use instead.

Mappings

Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.8.12Data leakage prevention measuresPartially meets
  • A.8.23Web filtering to reduce malicious website exposurePartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.