Essential Eight AH-ML2.5 Configure Microsoft Office to prevent activation of OLE packages

This control partially meets A.8.1.

E8-AH-ML2.5 requires a Microsoft Office endpoint configuration to prevent activation of OLE packages. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes hardening endpoint applications like Office. Annex A 8.1 is broader and outcome-focused, while E8-AH-ML2.5 is a specific application hardening measure contributing to that endpoint protection objective.

This control supports A.8.9.

E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of OLE packages. Annex A 8.9 requires configurations (including security configurations) to be established, documented, implemented, monitored and reviewed, which is the management process needed to apply and sustain Office configuration settings. E8-AH-ML2.5 is a single hardening requirement, whereas Annex A 8.9 provides the broader configuration management framework that makes the control durable and auditable.

This control is equivalent to ISM-1542.

E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of Object Linking and Embedding (OLE) packages. ISM-1542 states the same requirement for disabling or preventing OLE activation in Microsoft Office. Both controls are aligned in scope (Office configuration) and intent (reduce OLE-based attack paths), so implementing one would largely satisfy the other.

This control partially meets ISM-2110.

ISM-2110 requires user applications to be hardened in accordance with ASD and vendor hardening guidance, applying the most restrictive guidance where there is conflict. E8-AH-ML2.5 is a specific Microsoft Office hardening requirement (prevent activation of OLE packages) that would typically be derived from ASD/Microsoft guidance applied under ISM-2110. E8-AH-ML2.5 is therefore a concrete subset implementation example within the broader hardening obligation of ISM-2110.

This control partially overlaps ISM-0289.

ISM-0289 requires evaluated products to be configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.5 mandates a specific Microsoft Office configuration to prevent activation of OLE packages, which is a tangible example of enforcing secure product configuration settings. E8-AH-ML2.5 is a single hardening requirement for one product family, whereas ISM-0289 is broader and anchored to maintaining the overall evaluated configuration and correct operational state of any evaluated product.

This control partially overlaps ISM-1667.

E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of OLE packages to reduce embedded-object execution risk. ISM-1667 requires Microsoft Office to be blocked from creating child processes, which mitigates common post-exploitation behaviours used by malicious Office content. They overlap in reducing Office-borne malware execution pathways, but E8-AH-ML2.5 is specifically about OLE package activation whereas ISM-1667 targets process creation regardless of whether OLE is involved.

This control partially overlaps ISM-1668.

E8-AH-ML2.5 requires Microsoft Office to prevent activation of OLE packages to limit execution of embedded content. ISM-1668 blocks Microsoft Office from creating executable content, addressing a broader set of Office behaviours used to drop malware (including but not limited to OLE-delivered payloads). The controls intersect around preventing Office from being used as an initial infection vector, but each targets a different mechanism (OLE activation vs file creation).

This control partially overlaps ISM-1673.

ISM-1673 requires blocking Win32 API calls by Office macros to constrain macro capability. E8-AH-ML2.5 requires configuring Office to prevent activation of OLE packages, addressing a different Office abuse vector commonly used to execute embedded or linked content. Both reduce Office-borne code execution pathways, but they address different technical mechanisms (macro API calls versus OLE activation).

This control depends on ISM-1601.

E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of OLE packages. ISM-1601 requires implementation of Microsoft Attack Surface Reduction (ASR) rules, which commonly includes Office-hardening rules that reduce abuse of embedded content and related behaviours. ASR strengthens and can help enforce the intent of E8-AH-ML2.5, but it is broader and not limited to OLE package activation.

This control depends on ISM-1913.

E8-AH-ML2.5 requires implementing a defined Microsoft Office configuration that prevents OLE package activation. ISM-1913 requires approved configurations for IT equipment to be developed, implemented and maintained, which underpins an organisation's ability to standardise and enforce Office hardening settings. The primary control is a specific technical setting, while ISM-1913 is the broader prerequisite practice that enables consistent deployment and maintenance of that setting.

This control depends on ISM-1915.

E8-AH-ML2.5 requires a specific approved configuration in Microsoft Office to prevent activation of OLE packages. ISM-1915 requires organisations to develop, implement and maintain approved configurations for user applications, providing the governance and baseline management needed to mandate settings like disabling OLE activation. E8-AH-ML2.5 is a concrete configuration outcome, while ISM-1915 establishes the prerequisite configuration management approach for user applications.

This control partially overlaps IT.PRO-04.1.

IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.5 requires Microsoft Office to prevent activation of Object Linking and Embedding packages, an Office setting for such a baseline.