What an auditor, or Sekit's evidence engine, asks for.
Web and DNS filtering
The service or tool that blocks access to malicious and unwanted websites, whether by filtering DNS lookups (a DNS filtering service) or by filtering web URLs at the network level (a web proxy or secure web gateway).
From the Sekit evidence catalog
In practice
Web filtering usually comes down to one setting that either happens or does not: whether every company device points at a filtering DNS resolver, or whether some devices, especially personal phones and contractor laptops, still resolve through the ISP's default DNS with no protection at all. The gap shows up during an incident review, when the malicious domain a phishing email pointed to turns out to have been reachable from half the fleet. A working setup routes all managed devices through a resolver that blocks known-malicious domains, locks the company's own public DNS records with registrar transfer protections, and checks periodically that no device has quietly reverted to an unfiltered network configuration.
Common gaps
Company laptops route through the filtering resolver, but personal phones and contractor devices resolve DNS through the open internet with no protection.
The company's own public DNS records have no registrar-level protection, leaving them open to hijacking or unauthorized changes.
Nobody checks whether devices have quietly reverted to their default, unfiltered DNS settings after an OS update or a network change.
Questions your auditor will ask
Do all company devices route through a filtering DNS resolver?
Yes, every managed device is configured to resolve DNS through a service that blocks known-malicious domains.
Are the company's public DNS records protected against hijacking?
Yes, the domain is locked at the registrar with transfer protection, so DNS records cannot be changed without additional verification.
How do you know a device has not reverted to unfiltered DNS?
A periodic check compares each device's DNS configuration against the required resolver and flags any that have drifted.
Where regulation demands it
NIS2 6.9 requires protection against malicious software, and ENS mp.com.1 requires a secure perimeter that DNS filtering enforces at the network boundary.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.