Essential Eight RM-ML1.1 Disable Microsoft Office macros for users without a business need
What it says
Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only users with a specific business need can run Microsoft Office macros.
This control is about stopping unauthorised users from using Microsoft Office macros unless they have a clear business reason to do so. Macros can run harmful code if used by the wrong people, potentially leading to data theft or damage. By limiting who can use them, you're reducing the risk of a cyber attack on your organisation.
Free. Save your status, tasks and notes.
Why it matters
If users without a business need can run Office macros, malicious code may execute, leading to data compromise and operational disruption.
How to implement
The IT team should disable macros for all users by default.
They can do this by adjusting the group policy settings across all company computers.
System administrators should gather requests from users who claim a business need for macros.
They should verify if the need is legitimate before enabling macro access.
The security officer should maintain a list of users with macro access.
This list should be regularly reviewed and updated in the Active Directory group.
Regularly review and update who needs macro access-system administrators should remove macro permissions for users who no longer require it for their role.
Keep it running
Maintain an approved list of users who need Office macros, review it regularly, and disable macros by default for all others.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are macros disabled for users who do not have a business need?
Look at
Review the group policy settings for macro usage and verify they are set to disable macros by default.
Good evidence
Macro settings are configured to disable all macros by default, with exceptions noted and documented.
- Check 2 of 2What an auditor asks for
Ask for
Is there documentation of the business requirements for enabled macro access?
Look at
Check the records of business requirements and approvals for macro use.
Good evidence
There is clear documentation showing approvals for each user who has macro access, aligned with Active Directory permissions.
Mappings
Closest match in ASD Information Security Manual: ISM-1671, Disable Office macros for users lacking a demonstrated business requirement, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.15.
E8-RM-ML1.1 mandates a specific access rule: users without business need must not be able to run Office macros. Annex A 5.15 requires organisations to establish and implement access control rules based on business and security requirements, under which a 'no macros unless justified' policy would sit. Annex A 5.15 is broader and more governance-focused, while E8-RM-ML1.1 is a concrete technical restriction.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1671.
E8-RM-ML1.1 requires Microsoft Office macros to be disabled for users unless they have a demonstrated business need. ISM-1671 states the same requirement and intent, targeting macro execution for unauthorised/unjustified users. The scope and implementation outcome are substantially identical, so implementing one would largely satisfy the other.
This control partially overlaps ISM-1674.
ISM-1674 requires that only macros from a sandboxed environment, Trusted Location, or trusted publisher signature are allowed to execute. E8-RM-ML1.1 overlaps by reducing macro execution exposure through disabling macros for users without a business need, which complements ISM-1674's conditional allow-listing. ISM-1674 focuses on where/how macros may run, while E8-RM-ML1.1 focuses on who should have macros enabled at all.
This control partially overlaps ISM-1675.
ISM-1675 requires that macros signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. E8-RM-ML1.1 reduces macro risk by disabling macros entirely for users without a business need, which in practice also prevents enabling untrusted macros for those users. They overlap in limiting macro execution, but ISM-1675 is a conditional block based on publisher trust while E8-RM-ML1.1 is a user-scope reduction control.
This control depends on ISM-1489.
E8-RM-ML1.1 requires macros to be disabled for users without a business need. ISM-1489 supports this by ensuring users cannot change Microsoft Office macro security settings to re-enable macros or weaken the restriction. ISM-1489 does not decide who has a business need; it strengthens enforcement of the macro-disable decision made under E8-RM-ML1.1.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RM-ML1.1 requires Office macros to be disabled for users without a demonstrated business requirement, switching off what is not needed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.