ISO 27001 Annex A 8.23 Web filtering to reduce malicious website exposure

This control is broader than E8-AH-ML1.2.

E8-AH-ML1.2 requires that web browsers do not process Java content from the internet to reduce exposure to exploitation via browser-borne active content. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which can include blocking risky content types and scripts delivered from the web. Annex A 8.23 is broader because it covers overall web access management (not just Java) and may be implemented via multiple controls (filtering, isolation, policy, monitoring).

This control is equivalent to ISM-0963.

Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-0963 requires implementation of web content filtering to filter potentially harmful web-based content, aligning with the same intent and outcome, although ISM-0963 provides a more explicit implementation approach.

This control is broader than ISM-0267.

Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content. ISM-0267 applies this concept to a specific high-risk website class by requiring blocking access to non-approved webmail services, which reduces phishing and malware delivery. Annex A 8.23 is broader because it covers overall web destination access management beyond webmail services.

This control is broader than ISM-0961.

Annex A 8.23 requires external website access to be managed to reduce exposure to malicious content. ISM-0961 is a specific implementation approach that uses web filters to restrict client-side active content to an organisation-approved domain list, directly reducing exposure to web-based malware. Annex A 8.23 is broader because it can be satisfied through multiple mechanisms (e.g., category filtering, reputation services, DNS filtering), not only active content restrictions.

This control is broader than ISM-1171.

Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-1171 is a targeted web filtering control that blocks attempts to access websites via direct IP addresses, helping prevent bypass of domain-based filtering. Annex A 8.23 is broader because it addresses general website access management, whereas ISM-1171 focuses on a specific evasion technique.

This control is broader than ISM-1236.

ISM-1236 requires web content filters to block malicious domains, dynamic domains, and domains that can be registered anonymously for free. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which can be implemented via web filtering and domain/category blocking. ISM-1236 is a specific, prescriptive subset focused on domain-name blocking criteria, whereas Annex A 8.23 is broader and technology-agnostic about how web access is managed.

This control is broader than ISM-1485.

ISM-1485 requires blocking browsers from processing web advertisements from the internet to reduce exposure to malicious content delivered via advertising networks. Annex A 8.23 requires managing access to external websites (web filtering) to reduce exposure to malicious content more generally across web destinations and content types. ISM-1485 is a specific technique that can be implemented via browser policy or filtering mechanisms and therefore represents a subset of the broader web access management objective in Annex A 8.23.

This control is broader than ISM-1782.

Annex A 8.23 requires external website access to be managed to reduce exposure to malicious content. ISM-1782 specifies using protective DNS to block known malicious domain names, which directly implements malicious site blocking. Annex A 8.23 is broader because it does not prescribe DNS-based controls and can include methods such as proxy category filtering.

This control partially overlaps ISM-0659.

ISM-0659 requires that files imported or exported via gateways or cross domain solutions (CDSs) undergo content filtering checks to detect unwanted or harmful content. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, commonly using web filtering and content inspection technologies at network boundaries. They overlap where gateway security stacks apply URL/content inspection and malware filtering to content entering the organisation, but Annex A 8.23 is focused on web browsing destinations while ISM-0659 is specifically about file transfer through gateways/CDSs (including non-web transfer paths).

This control partially overlaps ISM-0958.

ISM-0958 requires an organisation-approved allow/block list of domain names or website categories for all HTTP/HTTPS traffic through gateways. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which is commonly achieved via domain/category filtering at gateways. Annex A 8.23 is outcome-focused and broader in permissible techniques, while ISM-0958 is a specific prescriptive mechanism (approved lists) and explicitly scoped to gateway HTTP/HTTPS traffic.

This control partially overlaps ISM-1237.

ISM-1237 requires web content filtering to be applied to outbound web traffic where appropriate. Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content, commonly implemented via web filtering/proxy controls. Both address controlling web access to reduce risk, but ISM-1237 is specifically framed around outbound traffic filtering (including suitability), while Annex A 8.23 is broader in intent (malicious website exposure) and not limited to outbound traffic implementation detail.

This control partially overlaps ISM-2068.

ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.23 relates by managing access to external websites through web filtering to reduce exposure to malicious content, controlling internet use once connectivity exists.

This control partially overlaps ISM-2112.

ISM-2112 requires disabling AI applications' direct access to external public data sources when processing classified data. ISO/IEC 27001:2022 Annex A 8.23 overlaps because web filtering and managed access to external websites can be used to restrict or block AI systems from reaching public internet sources. Annex A 8.23 focuses on reducing exposure to malicious content, whereas ISM-2112 is primarily about preventing classified data exposure via outbound access irrespective of maliciousness.

This control supports ISM-0258.

Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-0258 requires establishing a web usage policy, which supports Annex A 8.23 by defining acceptable use and responsibilities that inform filtering decisions. ISM-0258 is governance-focused, not implementing technical access management.

This control supports ISM-0260.

Annex A 8.23 requires organisations to manage access to external websites to reduce exposure to malicious content. ISM-0260 mandates that all web access is conducted through web proxies, providing a central enforcement point to implement and monitor website access controls and filtering. While Annex A 8.23 focuses on the outcome (reduced exposure via managed access), ISM-0260 is an architectural requirement that enables consistent application of web filtering and policy enforcement.

This control depends on ISM-0874.

ISM-0874 requires all user devices to route internet access through the organisation's gateway instead of direct connections. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites (e.g., web filtering) to reduce exposure to malicious content, which is typically enforced at a central gateway/proxy. ISM-0874 enables consistent application of web filtering and URL controls, but it does not itself require filtering decisions or policy enforcement that Annex A 8.23 focuses on.

This control partially overlaps IT.PRO-09.2.

IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked. It shares common ground with Annex A 8.23, since blocking known malicious websites is a core web filtering measure for reducing exposure to malicious content. IT.PRO-09.2 applies to all outbound connections rather than only web traffic, while Annex A 8.23 covers wider management of access to external websites.

This control partially overlaps IT.PRO-09.3.

IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content. It shares common ground with Annex A 8.23, as inspecting web content reduces exposure to malicious content from external websites. IT.PRO-09.3 covers all inbound channels, such as email and file transfers, while Annex A 8.23 also manages which external websites can be accessed at all.