Essential Eight AH-ML2.6 Office productivity suites are hardened using ASD and vendor guidance
What it says
Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure office suites follow the strictest security guidelines to reduce risks.
This control is about making sure that office software like Microsoft Word and Excel are set up to be secure. It's important because if these programs aren't properly protected, they could be a way for hackers to break into your computer and steal information or cause damage.
Free. Save your status, tasks and notes.
Why it matters
Poorly hardened office suites can enable macros and add-ins to be exploited, leading to data breaches and compromised systems.
How to implement
The IT team should review the vendor's security guidelines and the Australian Signals Directorate's recommendations for office software to ensure all settings are correctly applied.
System administrators need to configure office software settings using group policies so users can't change them later.
This can be done through a centralised management tool.
Security officers should conduct regular checks to make sure the most restrictive security settings are still in place and that no new vulnerabilities have been introduced with updates.
System administrators should regularly update office software to the latest version, as updates often include security patches for known vulnerabilities.
Keep it running
Regularly verify ASD and vendor hardening baselines for Office apps (macros, add-ins, Protected View) are enforced; apply the most restrictive setting if guidance conflicts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are security settings for office software determined?
Look at
Check the documentation detailing the security settings applied and compare them against ASD and vendor guidelines.
Good evidence
The settings should align with the most restrictive guidelines available from the ASD and the software vendor.
- Check 2 of 2What an auditor asks for
Ask for
How are users prevented from altering security settings?
Look at
Examine the group policy settings applied to the office software.
Good evidence
Group policy settings should prevent users from changing security configurations, and these settings should be visibly effective in the software.
Mappings
Closest match in ASD Information Security Manual: ISM-1859, Hardening Office productivity suites, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
E8-AH-ML2.6 requires implementing hardened configurations for office productivity suites based on ASD and vendor guidance. Annex A 8.9 requires configurations (including security configurations) for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which encompasses office suite hardening as one application-specific instance. Annex A 8.9 has broader scope and stronger lifecycle expectations (monitoring/review) than the specific office-suite hardening requirement in E8-AH-ML2.6.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1859.
ISM-1859 requires office productivity suites to be hardened using ASD and vendor hardening guidance, applying the most restrictive settings where guidance conflicts. E8-AH-ML2.6 states the same requirement with the same decision rule (most restrictive precedence) for the same technology scope. Implementing either control would largely satisfy the other for office productivity suite hardening.
This control is broader than ISM-1235.
E8-AH-ML2.6 requires hardening office productivity suites using ASD and vendor hardening guidance to reduce exposure to common attack techniques. ISM-1235 specifically requires restricting add-ons, extensions and plug-ins for office productivity suites to an organisation-approved set, which is a common and important part of suite hardening that would be implemented to satisfy E8-AH-ML2.6. E8-AH-ML2.6 is broader because it covers many hardening settings beyond add-on control (for example macro, trust centre, and security feature configurations).
This control is broader than ISM-1668.
E8-AH-ML2.6 requires organisations to harden office productivity suites using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. ISM-1668 is a specific hardening setting for Microsoft Office (blocking it from creating executable content) that would typically be included within an office suite hardening baseline. E8-AH-ML2.6 therefore encompasses ISM-1668 as one concrete configuration measure within the broader office suite hardening requirement.
This control partially meets ISM-1246.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.6 requires the same hardening approach but for office productivity suites. If productivity suites are installed on servers (e.g. for automation or remote app delivery), E8-AH-ML2.6 represents a specific subset of the broader server application hardening obligation in ISM-1246.
This control partially meets ISM-1858.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, defaulting to the most restrictive guidance when conflicts occur. E8-AH-ML2.6 implements that same principle specifically for office productivity suites. This is a direct subset of ISM-1858 because it narrows the hardening scope to one application class.
This control partially meets ISM-1915.
E8-AH-ML2.6 requires office productivity suites to be hardened using ASD and vendor hardening guidance, applying the most restrictive settings where guidance conflicts. ISM-1915 requires that approved configurations for user applications are developed, implemented and maintained, which would include office productivity suites as a class of user applications. ISM-1915 is broader across all user applications and does not specifically require reconciling ASD vs vendor guidance the way E8-AH-ML2.6 does.
This control partially overlaps ISM-0289.
ISM-0289 requires evaluated products to be installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.6 requires office productivity suites to be hardened using ASD and vendor guidance, overlapping on implementing and maintaining vendor-aligned secure configuration for operational software. E8-AH-ML2.6 is limited to a specific application class and hardening outcomes, while ISM-0289 is tied to the integrity of an evaluated configuration and applies across any evaluated product and its ongoing administration and operation.
This control depends on ISM-1823.
ISM-1823 requires office productivity suite security settings to be centrally enforced and not changeable by human users. E8-AH-ML2.6 requires office productivity suites to be hardened using ASD and vendor guidance, which typically defines the secure baseline settings that should be enforced. Locking settings under ISM-1823 helps ensure the hardening baseline required by E8-AH-ML2.6 remains effective and cannot be weakened by user behaviour.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires defining approved configuration baselines informed by vendor and industry hardening guidance; E8-AH-ML2.6 overlaps for office productivity suites but goes beyond defining a baseline, requiring them to be hardened using ASD and vendor hardening guidance, the most restrictive taking precedence in conflicts.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.6 applies this to office productivity suites, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.