Essential Eight AH-ML2.7 Office productivity suite settings are immutable by users

This control is equivalent to ISM-1823.

E8-AH-ML2.7 requires that office productivity suite security settings are immutable by users. ISM-1823 states the same requirement: Office productivity suite security settings cannot be changed by users. Both controls are aligned in scope (office productivity suites) and intent (prevent user modification of security configuration), so implementing one would largely satisfy the other.

This control is broader than ISM-1669.

ISM-1669 requires Microsoft Office to be blocked from injecting code into other processes. E8-AH-ML2.7 is broader, requiring Office productivity suite security settings to be immutable by users, which would typically include hardening settings such as those that prevent risky behaviours. ISM-1669 is one specific hardening outcome, while the candidate covers protection of the overall Office security configuration baseline.

This control partially meets ISM-1858.

ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, taking the most restrictive guidance when conflicts occur. E8-AH-ML2.7 requires that office productivity suite security settings cannot be changed by users, which is a hardening governance measure enforcing configuration immutability. The candidate is narrower because it applies to one application class and one aspect of hardening (preventing user tampering) within the wider ISM-1858 requirement.

This control partially meets ISM-1859.

ISM-1859 requires office productivity suites to be hardened using ASD and vendor guidance, choosing the most restrictive configuration when there is a conflict. E8-AH-ML2.7 is a specific hardening outcome requiring those suite security settings to be enforced so users cannot change them. ISM-1859 encompasses this immutability as one possible hardening requirement, but also covers many other hardening settings beyond user immutability.

This control partially overlaps ISM-0382.

ISM-0382 requires that unprivileged users cannot uninstall or disable approved applications. E8-AH-ML2.7 similarly prevents users from changing office productivity suite security settings, which is a form of restricting unprivileged user ability to weaken an approved application's protections. However, E8-AH-ML2.7 is configuration immutability for a specific application class, whereas ISM-0382 is broader and targets uninstall/disable actions across approved applications.

This control partially overlaps ISM-1489.

E8-AH-ML2.7 requires that office productivity suite security settings cannot be changed by users. ISM-1489 specifically requires that Microsoft Office macro security settings cannot be changed by users, which is a key subset of office security configuration. The overlap is on preventing users weakening Office security posture, but ISM-1489 is narrower (macros only) while E8-AH-ML2.7 covers the broader set of Office security settings beyond macros.

This control partially overlaps ISM-1748.

ISM-1748 requires email client security settings to be centrally enforced so human users cannot change, weaken or override them. E8-AH-ML2.7 requires office productivity suite security settings to be immutable by users, which can include email-client settings where the email client forms part of the suite (e.g. Outlook), and is typically enforced through centrally managed policy. The overlap is the shared intent of preventing end-user modification of client application security posture, but ISM-1748 is specifically scoped to email clients, whereas E8-AH-ML2.7 is broader across the productivity suite and may not cover standalone/non-suite email clients.

This control partially overlaps ISM-1824.

ISM-1824 requires PDF application security settings to be locked against user changes. E8-AH-ML2.7 similarly requires office productivity suite security settings to be immutable by users, reflecting the same governance pattern of centrally enforced application hardening. They overlap on the concept of preventing users from weakening application security through immutability, applying to different application families (PDF software vs office suites).

This control partially overlaps ISM-1825.

ISM-1825 requires that security product security settings cannot be changed by human users to preserve endpoint protections. E8-AH-ML2.7 similarly mandates that office productivity suite security settings are immutable by users, applying the same anti-tamper principle to a specific application class. E8-AH-ML2.7 is focused on productivity suite hardening rather than security products like antivirus/EDR/firewalls, so the overlap is in the control objective (prevent user changes), not the protected technology category.

This control supports ISM-1542.

E8-AH-ML2.7 requires that office productivity suite security settings cannot be changed by users. ISM-1542 mandates configuring Microsoft Office to prevent activation of OLE packages, which is one concrete Office security hardening setting that should be enforced centrally. While ISM-1542 does not itself require immutability of settings, making Office settings immutable (E8-AH-ML2.7) helps ensure the OLE restriction in ISM-1542 remains enforced and cannot be user-disabled.

This control depends on ISM-1915.

ISM-1915 requires maintenance of approved configurations across applications. E8-AH-ML2.7 assists by enforcing immutable security settings for office suites.

This control partially overlaps IT.PRO-04.1.

IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.7 requires that users cannot change office productivity suite security settings, which protects those settings in such a baseline.