[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-23":3},{"item":4,"lessons":16,"controls":26,"related":40},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-23","Annex A 8.23","ISO\u002FIEC 27001:2022 Annex A 8.23: Web filtering",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects access to external websites to be managed to reduce exposure to malicious content. It was new in the 2022 edition. Its purpose is to protect systems from malware and prevent access to unauthorised web resources.\n\n**In practice.** Good practice means blocking known malicious and high-risk sites, using categories and reputation services, and applying rules consistently whether users are in the office or remote. Rules on acceptable use are communicated and exceptions are approved. Auditors look for filtering configuration, coverage for remote users and records of reviewing blocked categories and exceptions.\n\n**Common gaps.** Common gaps are filtering only on the office network, no coverage on mobile devices and rules not updated as new threats appear. Users are also not always told why a site was blocked or how to request access.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"attackers-weaponize-trusted-ai-platforms-to-deliver-malware","Attackers Weaponize Trusted AI Platforms to Deliver Malware","2026-09-11T16:21:15.497+00:00",{"slug":23,"title":24,"published_at":25},"gdpr-liability-confirmed-data-scraping-alone-constitutes-non-material-damage","GDPR Liability Confirmed: Data Scraping Alone Constitutes Non-Material Damage","2026-06-24T10:20:18.741+00:00",[27,32,36],{"slug":28,"name":29,"problem":30,"stories":31},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,{"slug":33,"name":34,"problem":35,"stories":31},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":37,"name":38,"problem":39,"stories":31},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[41,46,51,55,59,63,67,71],{"family":42,"item":43,"code":44,"title":45,"together":9},"gdpr","32","Article 32","Security of processing",{"family":47,"item":48,"code":49,"title":50,"together":31},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":47,"item":52,"code":53,"title":54,"together":31},"3","Control 3","Data Protection",{"family":47,"item":56,"code":57,"title":58,"together":31},"9","Control 9","Email and Web Browser Protections",{"family":42,"item":60,"code":61,"title":62,"together":31},"25","Article 25","Data protection by design and by default",{"family":47,"item":64,"code":65,"title":66,"together":31},"14","Control 14","Security Awareness and Skills Training",{"family":42,"item":68,"code":69,"title":70,"together":31},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":47,"item":72,"code":73,"title":74,"together":31},"13","Control 13","Network Monitoring and Defense"]