What it asks for. This control expects access to external websites to be managed to reduce exposure to malicious content. It was new in the 2022 edition. Its purpose is to protect systems from malware and prevent access to unauthorised web resources.
In practice. Good practice means blocking known malicious and high-risk sites, using categories and reputation services, and applying rules consistently whether users are in the office or remote. Rules on acceptable use are communicated and exceptions are approved. Auditors look for filtering configuration, coverage for remote users and records of reviewing blocked categories and exceptions.
Common gaps. Common gaps are filtering only on the office network, no coverage on mobile devices and rules not updated as new threats appear. Users are also not always told why a site was blocked or how to request access.