ASD ISM 1237 Implement web content filters for outbound traffic
What it says
Web content filtering is applied to outbound web traffic where appropriate.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse web filters on outgoing internet traffic to block unsuitable content where necessary.
Web content filters are like security guards for your internet. They keep an eye on what information travels from your organisation to the web, blocking harmful or inappropriate content. Without these filters, your business could be at risk of security breaches, employee misuse, or legal issues.
Free. Save your status, tasks and notes.
Why it matters
Without outbound web content filtering, organisations risk data exfiltration, malware downloads and policy breaches, causing financial loss and reputational harm.
How to implement
IT Team: Install web filtering software on your network to automatically block access to harmful websites.
Ensure it is configured to recognise and filter out inappropriate content categories like gambling, adult content, or known cyber threat sites.
Procurement: Work with your IT team to select a web filtering service that is cost-effective and aligns with the needs of your organisation.
Compare different providers' features, ease of use, and support offerings to make an informed decision.
Senior Management: Communicate the importance of web content filters to staff through a formal policy and regular training sessions.
Explain how these filters protect the organisation and why certain websites may be blocked.
HR: Collaborate with IT to ensure that employee guidelines on acceptable internet use are clear and that disciplinary actions for breaches are well-defined.
Regularly update these documents and share them with all staff.
IT Team: Regularly review and update the filter settings to adapt to new threats and company policies.
Develop a routine check-up schedule to ensure the filtering software is running effectively and efficiently.
Keep it running
Review filter categories and proxy rules regularly, tune allow/deny lists, and monitor logs for bypass attempts. Enable SSL inspection only where approved and documented.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web filtering policy document: Request a copy of the formal policy detailing web filtering practices.
Look at
The document for clear categories and examples of blocked content.
Good evidence
Shows a comprehensive list of blocked categories with clear explanations.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the web filtering system: Request to see the software in action blocking inappropriate websites.
Look at
The system's logs or dashboard for real-time blocking activity.
Good evidence
Demonstration shows active, effective blocking and categorisation.
- Check 3 of 5What an auditor asks for
Ask for
User access logs from the web filter: Request logs that show blocked attempts to access unsuitable websites.
Look at
Timestamps, source IP addresses, and blocked categories.
Good evidence
Record includes regular blocks consistent with the policy.
- Check 4 of 5What an auditor asks for
Ask for
The IT maintenance schedule: Request documentation of routine checks and updates to the filtering system.
Look at
Recent activity logs and update records.
Good evidence
Includes a clearly followed schedule with evidence of consistent reviews.
- Check 5 of 5What an auditor asks for
Ask for
Training materials related to web filtering: Request copies of slides, manuals, or meeting minutes from training sessions.
Look at
Content included in training sessions aimed at educating employees about web filtering and acceptable use policies.
Good evidence
Includes up-to-date materials with attendance records.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.23.
ISM-1237 requires web content filtering to be applied to outbound web traffic where appropriate. Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content, commonly implemented via web filtering/proxy controls. Both address controlling web access to reduce risk, but ISM-1237 is specifically framed around outbound traffic filtering (including suitability), while Annex A 8.23 is broader in intent (malicious website exposure) and not limited to outbound traffic implementation detail.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.1Inspect outbound content on egress paths to detect unauthorised data transfersPartially overlaps
This control partially overlaps IT.PRO-09.1.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-1237 requires web content filtering to be applied to outbound web traffic where appropriate, covering the web channel of that inspection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.