ASD ISM 0958 Implement domain name allow and block lists
What it says
An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate a list of approved or blocked domains for secure web traffic management.
This control is about managing which websites people in your organisation can visit. By approving or blocking specific websites, you can prevent staff from accidentally visiting harmful or inappropriate sites, which can protect your data and your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Without managed domain allow/block lists for web gateway traffic, users may reach malicious sites, causing malware infection, credential theft and data breaches.
How to implement
The IT team should create a list of approved websites your organisation finds safe and necessary for work.
They can start by asking staff which sites are needed daily and checking these sites for safety using a reliable online tool.
Managers should communicate with staff about the rules on accessing websites.
They should explain why certain sites are blocked and how sticking to approved websites can protect the organisation's data and prevent security breaches.
The IT team should use software to enforce the approved and blocked website list.
They can do this by configuring the internet settings on office computers so that these settings automatically block or allow specific websites.
It's important for the IT team to regularly review and update the approved and blocked lists.
They should schedule regular checks to ensure the lists are current, removing sites no longer needed and adding new ones as necessary.
The IT team should provide training sessions for staff about internet safety and the importance of following the approved site list.
They can conduct these sessions quarterly to keep internet safety a top priority.
Keep it running
Maintain allow/block and category lists on all HTTP/HTTPS gateways, review exceptions, update from threat intel, and prevent bypass via direct IP, alternate DNS or proxies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved and blocked website list: Request the latest version from the IT department.
Look at
The document to see if it's dated and includes both allowed and blocked websites.
Good evidence
The list is current, clearly marked as approved by management, and includes a rationale for each addition or removal.
- Check 2 of 5What an auditor asks for
Ask for
To see the software used for web traffic management: Request a demonstration from the IT team to show how the software works.
Look at
Whether the software automatically blocks and allows sites based on the implemented list.
Good evidence
The software actively enforces the approved and blocked list and shows logs of blocked access attempts.
- Check 3 of 5What an auditor asks for
Ask for
A record of regular reviews of the website lists: Check for documented reviews done by the IT team.
Look at
How often the list is reviewed and updated.
Good evidence
The document shows reviews are done quarterly and includes changes with reasons.
- Check 4 of 5What an auditor asks for
Ask for
To see training records on internet safety for staff: Request evidence of training sessions conducted.
Look at
The content of the sessions and attendance records.
Good evidence
Sessions cover internet safety, and attendance records show high staff participation.
- Check 5 of 5What an auditor asks for
Ask for
Management approval documents for the website lists: Request the signed approval or email confirmations of the list.
Look at
Who in management approved the list and if there's a review schedule mentioned.
Good evidence
The document is signed by a manager and includes a future review date.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.23.
ISM-0958 requires an organisation-approved allow/block list of domain names or website categories for all HTTP/HTTPS traffic through gateways. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which is commonly achieved via domain/category filtering at gateways. Annex A 8.23 is outcome-focused and broader in permissible techniques, while ISM-0958 is a specific prescriptive mechanism (approved lists) and explicitly scoped to gateway HTTP/HTTPS traffic.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligencePartially overlaps
This control partially overlaps IT.PRO-09.2.
IT.PRO-09.2 requires outbound connections to known malicious or untrusted destinations to be blocked; ISM-0958 requires an organisation-approved list of domain names or website categories for all HTTP and HTTPS traffic through gateways, an approved-list approach to that blocking.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.