Why it matters
Reduces the chance staff land on malicious sites, a common phishing and malware delivery route.
How a self-led small team implements it
Modern browser/OS-level protections plus awareness training can be a legitimate proportionate control if you don't run dedicated filtering.
What auditors expect to see
Web filtering configuration, or documented compensating controls.
Track A.8.23 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS