ASD ISM 1171 Block direct IP access to websites
What it says
Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb filters prevent website access if using an IP address instead of a domain name.
This control means stopping people from visiting websites using IP addresses instead of the usual website names. It's important because some bad actors try to bypass security filters by using these numerical addresses directly, which could lead to data theft or malware infections.
Free. Save your status, tasks and notes.
Why it matters
By blocking direct IP access, organisations prevent attackers from bypassing DNS-based content filters, reducing exposure to phishing and malware sites.
How to implement
IT teams should set up web content filtering tools.
Choose a reliable web filtering service that specifically blocks direct IP address usage and configure it to treat attempts to access websites by IP as red flags.
System administrators should carry out regular tests.
Use sample IP addresses of known websites to ensure that attempts to access them directly are indeed blocked by the filtering system.
Business managers should work with the IT team to ensure blocked access policies are communicated effectively.
Clearly inform all staff that accessing websites using IP addresses is against company policy and part of the security measures.
HR should include training on secure browsing habits.
Implement regular training sessions that explain the risks of navigating to sites using IP addresses and educate staff on the filtering mechanisms in place.
Procurement teams should ensure that any new web filtering software purchased supports IP blocking.
When evaluating new systems, confirm they offer robust IP filtering and request demonstrations from vendors.
Keep it running
Keep web filter rules current; ensure IP-based URL requests are blocked, logged, and reviewed so attempts to bypass domain filtering are detected.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Proof of the web content filter settings: Request screen captures or reports from the web filter administration interface.
Look at
Settings specifically designed to block direct IP access.
Good evidence
Clear evidence showing a configured rule that blocks IP-based web access.
- Check 2 of 5What an auditor asks for
Ask for
Recent log reports of blocked IP access attempts: These should be logs generated by the web filtering system.
Look at
Entries that show attempted IP-based access and successful blocking.
Good evidence
Is a detailed log with timestamps, source IPs, and actions taken.
- Check 3 of 5What an auditor asks for
Ask for
Documentation or memo on policy communication: Request the internal memo or policy document circulated to staff regarding web access rules.
Look at
How the policy is communicated and its clarity.
Good evidence
Includes a formally distributed document with a clear explanation of the rules.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request records or sign-in sheets from training sessions conducted about the control.
Look at
Evidence that employees have attended training and understood the content.
Good evidence
Is a dated record showing attendees and training outlines.
- Check 5 of 5What an auditor asks for
Ask for
Vendor evaluation documents: Request the criteria or checklists used when purchasing web filtering solutions.
Look at
The emphasis on the ability to block IP access in the requirements.
Good evidence
Includes detailed evaluations that explicitly mention IP blocking capabilities.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
ISM-1171 requires web content filters to block attempts to access websites via direct IP address rather than by domain name. Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content, which can be implemented using web filtering controls (including restrictions on IP-based browsing). ISM-1171 is a specific filtering rule/technique, while Annex A 8.23 is broader and outcome-focused across all external web access management.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligencePartially overlaps
This control partially overlaps IT.PRO-09.2.
IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked; ISM-1171 requires web content filters to block attempts to access websites by IP address instead of domain name, one specific outbound blocking rule for web traffic.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.