ASD ISM 0963 Implementing web content filters for safety
What it says
Web content filtering is implemented to filter potentially harmful web-based content.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb filters help block harmful content from the internet.
Web content filtering involves setting up systems to block or limit access to certain types of online content that could be harmful, like malicious websites or inappropriate material. This matters because without filtering, people might accidentally access harmful or illegal sites, leading to security breaches or reputational damage for your organisation.
Free. Save your status, tasks and notes.
Why it matters
Without web content filtering, users may access phishing or malware sites, causing credential theft, malware infection, and data breaches.
How to implement
Managers should consult with the IT team to determine which categories of web content need to be filtered, such as sites known for malware or adult content.
Discuss what types of content could be harmful to your organisation's operations and reputation.
HR should establish clear policies outlining acceptable internet use to align with the web filtering solution.
Communicate these policies during training sessions and ensure employees know who to contact if they accidentally encounter restricted content.
Procurement should source and fund the web filtering solution.
Obtain quotes, assess the compatibility with existing systems, and factor in any ongoing subscription or maintenance costs. Ensure the selection aligns with security standards set by the Australian Cyber Security Centre (ACSC).
System owners should regularly review and update the web filter categories.
Schedule periodic reviews with the IT team to adjust settings based on evolving threats and operational needs, ensuring the filters remain effective as part of your overall security strategy.
Keep it running
Maintain category/URL rules and reputation feeds, test blocked/allowed lists, and review filter logs to tune policies and reduce bypass attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of filtered web content categories: Request a document or dashboard screenshot showing which types of content are currently blocked by the web filtering system.
Look at
A comprehensive list that includes categories like malware, adult content, and social media.
Good evidence
Includes up-to-date categories tailored to the organisation's needs and security policy.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of web filtering policy communication: Request records of training sessions or communication methods used to inform staff about web filtering policies.
Look at
Attendance logs or email distributions that confirm staff have been informed.
Good evidence
Shows consistent communication and training records.
- Check 3 of 5What an auditor asks for
Ask for
The IT team to show how the filtering is implemented on their system.
Look at
Ease of use and how blocking or allowing exceptions is handled.
Good evidence
Demonstration shows the system filtering effectively and the team's understanding of its operation.
- Check 4 of 5What an auditor asks for
Ask for
System logs or reports: Request logs or reports that detail blocked attempts or access attempts to restricted content.
Look at
Reports that are regularly reviewed and any actions taken as a result.
Good evidence
Will show regular monitoring and adjustments based on these reports.
- Check 5 of 5What an auditor asks for
Ask for
To see the review and update schedule: Request the schedule document that outlines how often the web filtering categories and the system configuration are reviewed.
Look at
Regular review dates and responsible individuals.
Good evidence
Includes a schedule with dates for future reviews and evidence of past reviews.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control is equivalent to A.8.23.
Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-0963 requires implementation of web content filtering to filter potentially harmful web-based content, aligning with the same intent and outcome, although ISM-0963 provides a more explicit implementation approach.
ASD Essential Eight: 2 mappings
This control is broader than E8-AH-ML1.3.
E8-AH-ML1.3 requires preventing web browsers from processing internet-served advertisements. ISM-0963 requires implementing web content filtering to block potentially harmful web-based content, which can include advertising and related ad networks as part of broader content categories. E8-AH-ML1.3 is a specific subset of the broader web filtering outcome described by ISM-0963.
This control partially overlaps E8-AH-ML1.2.
ISM-0963 requires organisations to implement web content filtering to block potentially harmful web-based content. E8-AH-ML1.2 relates by hardening browsers so they must not execute Java content from the internet, which reduces exposure to a common web-delivered attack vector. The overlap is in reducing harmful web content impact, but E8-AH-ML1.2 is an endpoint/browser execution restriction rather than an organisation-wide web filtering control (e.g. category/URL filtering).
ASD Essentials for enterprise IT: 3 mappings
- IT.PRO-09.1Inspect outbound content on egress paths to detect unauthorised data transfersPartially overlaps
This control partially overlaps IT.PRO-09.1.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-0963 requires web content filtering of potentially harmful web-based content, a related capability aimed at harmful content, not outbound data.
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligencePartially overlaps
This control partially overlaps IT.PRO-09.2.
IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked; ISM-0963 requires web content filtering of potentially harmful web-based content, which overlaps on web traffic but filters content rather than destinations.
- IT.PRO-09.3Inspect all inbound content channels and block malicious or unsafe contentPartially overlaps
This control partially overlaps IT.PRO-09.3.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-0963 requires web content filtering of potentially harmful web-based content, applying that inspection to the web.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.