ASD ISM 0961 Restrict active content with web filters
What it says
Client-side active content is restricted by web content filters to an organisation-approved list of domain names.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb filters block active content from unapproved websites.
Using web filters to restrict active content from unapproved websites is like having a security guard at the entrance of a building who only lets in trusted people. This is important because if you don't control what content can enter your organisation's computers, malicious software could slip in and cause massive problems, like slowing down important services or stealing sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without web filters, active content from malicious sites can exploit vulnerabilities, leading to data breaches and operational disruption.
How to implement
The IT team should install and configure a web filtering solution.
They can do this by choosing a reputable web filtering service that is compatible with existing systems and setting it to block any active content, such as JavaScript or Flash, from websites not on an approved list.
The system owner should work with department heads to compile a list of websites that are necessary for business operations.
They should identify which sites employees need for their work and ensure these are added to the 'approved' list in the web filter settings.
The IT team should regularly update the web filter to adapt to new threats.
They can do this by subscribing to threat intelligence feeds and regularly reviewing and updating the list of approved and blocked sites based on the latest security advice.
Managers should inform employees about the web filtering policy and its purpose.
They should hold brief information sessions or distribute documents explaining why certain sites are blocked and how employees can request access to additional sites when needed.
The compliance officer should periodically check that the web filtering settings align with organisational policies.
They should review the settings every three months and after any major update to the policy to ensure continued compliance with security standards.
Keep it running
Maintain the organisation-approved domain allowlist, update it regularly, and review web filter logs/alerts for blocked active content to detect misuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web filter configuration document: Request documentation showing how web filters are set up.
Look at
Whether it includes details on blocked and approved sites.
Good evidence
Includes a recent review date and a clearly defined list.
- Check 2 of 5What an auditor asks for
Look at
Logs to see patterns and if malicious sites were effectively blocked.
Good evidence
Outcome is a report showing successful blocking of unauthorised sites with minimal false blocks of necessary content.
- Check 3 of 5What an auditor asks for
Ask for
A list of approved websites: Ensure it matches the operational needs.
Look at
Whether it has been updated recently and who authorised changes.
Good evidence
List is current, relevant, and linked to specific business requirements.
- Check 4 of 5What an auditor asks for
Look at
Coverage of why and how web filtering is used.
Good evidence
Record shows participation and understanding by employees across teams.
- Check 5 of 5What an auditor asks for
Ask for
To see threat intelligence subscription materials: Verify that the organisation stays informed about new security threats related to web content.
Look at
Active subscriptions and use of threat intelligence data in decision-making.
Good evidence
Demonstration includes regular updates to filter settings based on new intelligence.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
ISM-0961 requires organisations to use web content filters to restrict client-side active content to an organisation-approved list of domain names. Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which can be achieved through a range of approaches including allowlisting, blocklisting, reputation controls, and content inspection. ISM-0961 is a specific implementation pattern (active content restriction via domain allowlisting) that fits within the broader intent of Annex A 8.23.
ASD Essential Eight: 1 mapping
This control partially meets E8-AH-ML1.2.
E8-AH-ML1.2 requires that web browsers do not process Java content from the internet. ISM-0961 requires client-side active content to be restricted by web content filters to an organisation-approved list of domain names, which can include restricting Java and similar active content. ISM-0961 is broader because it governs multiple forms of active content and uses domain allow-listing as the control mechanism, whereas E8-AH-ML1.2 is a specific prohibition focused on Java execution.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.