Web filtering for business with Zenarmor: ISO 27001 A.8.23 done practically and GDPR-proof

A web filter decides which websites staff, guests and devices may visit, based on category and reputation. ISO 27001:2022 explicitly asks for this in control A.8.23: access to external websites must be managed to reduce exposure to malicious content. According to its own documentation, Zenarmor classifies more than 300 million websites in 120+ categories, blocks phishing, malware and botnet C&C using cloud threat intelligence, and enforces Safe Search — per user, group or VLAN.

This article explains what A.8.23 actually requires, how Zenarmor’s web filter works (profiles, security categories, DNS inspection, exceptions), how to set it up in a GDPR-compliant way and how to roll it out step by step. We write as an independent ISO 27001 Lead Auditor and as an official Zenarmor partner in the Netherlands, so we cover both the technology and what an auditor wants to see.

What does ISO 27001:2022 control A.8.23 (web filtering) require?

Web filtering is one of the new controls in the 2022 edition of the standard (see ISO 27001:2022 — what has changed). The control itself is brief: manage access to external websites to reduce exposure to malicious content. The detail sits in the guidance standard ISO/IEC 27002:2022, section 8.23. In summary, it covers:

• Blocking risky destinations such as known or suspected malicious sites (malware, phishing), command-and-control servers, malicious sites identified through threat intelligence and websites sharing illegal content.
• Considering blocking websites with an upload function unless there is a valid business reason.
• Rules for safe and appropriate use of online resources, including restrictions on undesirable websites and web applications, kept up to date.
• Training staff in the secure and appropriate use of the web.

In practice, A.8.23 links to A.5.7 (threat intelligence), A.8.7 (protection against malware), A.5.10 (acceptable use), A.6.3 (awareness) and A.8.15/A.8.16 (logging and monitoring). For A.8.23 an auditor looks at four things: is there an approved policy; is it technically enforced on all relevant networks and devices; is there an exception process; and is effectiveness reviewed periodically? For organisations in scope of NIS2, web filtering also supports the basic cyber hygiene practices in Article 21 — see ISO 27001 and NIS2.

How Zenarmor’s web filter works

Categories and cloud classification

For every connection, Zenarmor determines the web category of the destination. The web controls documentation refers to “300+ million websites in 120+ categories”. Classification comes from the Zenarmor cloud: the engine queries the nearest cloud servers and keeps a fast local cache. Want to know how a site is categorised? Use the public site classification lookup.

Profiles: Permissive, Moderate, High and Custom

You don’t need to configure 120 categories one by one. Zenarmor provides predefined profiles:

Profile	What is blocked (per Zenarmor docs)	Typical use
Permissive	No content categories; unrestricted browsing	Only combined with security categories, e.g. for IT administrators
Moderate	Adult, Advertisements, Illegal Drugs, Pornography, Violence	Offices, healthcare, guest Wi-Fi
High	Moderate plus Blogs, Chats, Dating, Gambling, Games, Social Networks, Software Downloads and more	Schools, kiosks, shared or public workstations
Custom	Your own selection; the profile switches to Custom automatically when you change a category	Organisations with a specific policy

According to the documentation, the Custom profile is reserved for paid editions; the free edition offers three preset profiles. For business use with multiple policies (per group or VLAN), choose a business plan, starting with Unified Secure.

Security categories: Essential and Advanced

Alongside content categories, Zenarmor has security rules in two layers. These are the core of A.8.23:

• Essential: malware/virus, phishing, hacking, spam sites, potentially dangerous, parked domains and firstly seen sites (domains the classification engine has not encountered before).
• Advanced: recent malware, phishing and virus outbreaks, botnet C&C, compromised websites, spyware and adware, keyloggers and monitoring, dynamic DNS sites, newly registered sites and newly recovered sites.

Newly registered domains and firstly seen sites are particularly valuable against phishing, because campaigns often use domains that are only days old. Zenarmor notes that the availability of Advanced Security depends on your subscription.

Cloud threat intelligence

Reputation data comes from Zenarmor’s cloud threat intelligence. According to Zenarmor, queries are sent encrypted and processed anonymously without personally identifiable information, and are not kept for longer than seven days. That matters for your record of processing and your processor agreements, so include it in your GDPR assessment.

Safe Search and YouTube Restricted Mode

Per policy you can enforce Safe Search for search engines such as Google, Bing, DuckDuckGo and Yandex, as well as YouTube. Explicit images, videos and results are then filtered out of search results. YouTube Restricted Mode also hides sexually explicit and other unsuitable videos. For schools, childcare, libraries and public Wi-Fi this is often the single most important setting. Because it works per policy, you can enable it on the pupil or guest VLAN and leave it off for staff.

DNS deep inspection: tunnels and DGA domains

Attackers like to use DNS as a covert channel: to smuggle data out (DNS tunnelling) or to let malware contact a botnet through algorithmically generated domains (DGA). Zenarmor’s content inspection rules therefore include DNS deep inspection, which detects malicious DNS tunnels, malformed or non-standard DNS transactions and botnet DGA queries. Each feature has three modes: Disabled, Log and Block. Start with Log, watch what happens, then switch to Block. DNS deep inspection is part of the paid editions.

General advice: make sure clients use your own DNS resolver and restrict DNS that bypasses the gateway. Otherwise you lose visibility of part of the traffic.

Exceptions and allow-lists

No web filter is perfect. Sometimes a legitimate supplier site is classified too strictly, or a department demonstrably needs access to a blocked category. That is what exclusions are for: a whitelist (always allow) and a blacklist (always block) for IP addresses, CIDR ranges, domains and hostnames. Exclusions take precedence over security, app and web rules and can apply globally or per policy.

Need URL-level blocking with wildcards or regular expressions? According to the documentation, this is available in the ZTNA, SSE and SASE subscriptions and only with full TLS inspection.

More important than the technology is the process. Define who may request an exception, who approves it, on what grounds and until when. Auditors ask for that register, and a whitelist entry with no end date is a classic finding.

Privacy and GDPR: proportionate and transparent

A web filter processes personal data: who visited which destination, and when. That is allowed, but within the limits of the GDPR. The Dutch Data Protection Authority, for example, states that employers may set rules for internet use and check compliance, provided staff know the rules in advance and know that checks are possible (Autoriteit Persoonsgegevens). Our rules of thumb:

• Block rather than watch. A filter that stops risky categories is more proportionate than analysing individual browsing behaviour after the fact.
• Transparency. Put the rules in your acceptable use policy or IT code of conduct, and communicate them before go-live.
• Purpose limitation and retention. Use logs for security and troubleshooting, set an appropriate retention period and restrict who may view individual data.
• Works councils and DPIA. In the Netherlands (Article 27 WOR) and Germany (Section 87 BetrVG), systems capable of monitoring behaviour usually require works council consent; in France the CSE must be consulted. Systematic monitoring may also require a DPIA. See our article on TLS inspection, GDPR and works councils.

For how to combine information security and privacy in one management system, read GDPR and ISO 27001 together.

Reporting: from blocked request to audit evidence

Zenarmor reports locally (Elasticsearch or SQLite) or in the cloud, with more than 60 reports according to Zenarmor. Since version 2.7 you can choose regions including the Netherlands or Germany for cloud reporting. You can also stream reporting data to an external Elasticsearch, Syslog or SIEM. For A.8.23, the most relevant views are blocked security categories over time, top blocked domains, the impact of new threats and the list of active exclusions. How to organise that as audit evidence is covered in Zenarmor reporting for NIS2 and ISO 27001.

A.8.23 translated into Zenarmor settings

Element of ISO 27002 (8.23)	Zenarmor feature	Evidence for the auditor
Block malicious sites (malware, phishing)	Essential Security: Malware/Virus, Phishing	Policy export, blocked-threats report
Command-and-control servers	Advanced Security: Botnet C&C; DNS deep inspection (DGA)	Report, SIEM alerts where applicable
Threat intelligence (link to A.5.7)	Cloud threat intelligence, Newly Registered Sites	Documented source, active categories
Illegal and unwanted content	Moderate/High/Custom profile, Safe Search	Acceptable use policy plus profile settings
Sites with upload functions	File-sharing categories; action control via CASB (SSE and higher)	Risk assessment and policy
Keeping rules current, exceptions	Exclusions with timestamps, Zenconsole audit trail	Exception register, review minutes

For uploads to file-sharing services, see our article on SSE, CASB and DLP. For app-based blocking (AI tools, remote access, peer-to-peer), read Zenarmor application control.

Sector examples

• Education: High or Custom profile on the pupil network, Safe Search and YouTube Restricted Mode on, and a schedule for lesson times. Staff get a broader profile. Zenarmor publishes customer stories from European education, including the City of Nordhorn (Germany) and GIP RECIA with DynFi (France).
• Healthcare: Moderate plus all security categories on the clinical network, and a separate patient Wi-Fi with Safe Search. That fits NEN 7510 and NIS2 obligations in the sector.
• Offices and professional services: Moderate or Custom, Essential and Advanced Security on Block, newly registered domains blocked and DNS deep inspection enabled. Exceptions only through the register.
• Guest Wi-Fi: its own VLAN, captive portal, Moderate with Safe Search and all security categories, so your public IP address and reputation are protected against misuse.

Rollout in six steps

Limits: HTTPS and devices off the network

Category filtering works without decryption: Zenarmor uses the hostname from the TLS handshake and DNS, so you block per domain. If you want to filter at path level (one page on an otherwise allowed site) or stop uploads within a service, you need full TLS inspection, with all the privacy and management questions that come with it. Encrypted Client Hello can also hide the hostname. So read our article TLS inspection with Zenarmor first. Protect laptops outside the office with the endpoint agents, so the same web policy applies at home and on the road.