Essential Eight RM-ML1.2 Block Microsoft Office macros from the internet
What it says
Microsoft Office macros in files originating from the internet are blocked.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent macros in files from the internet from being opened in Microsoft Office.
Blocking Microsoft Office macros from the internet is about preventing sneaky software from running on your computer when you open a document. Without this control, a seemingly harmless file from an unknown email or website could secretly run harmful code, stealing your data or damaging your systems.
Free. Save your status, tasks and notes.
Why it matters
If internet-sourced Office macros aren't blocked, users can run malicious code leading to ransomware, data loss, and outages.
How to implement
The IT team should review and update group policies to ensure that macros from the internet are blocked in Microsoft Office applications.
They can do this by setting the macro security to 'disable all macros with notification' for all users.
System administrators should apply specific settings in the Microsoft Office Trust Centre to block macros from the internet.
They can access this by going to File > Options > Trust Centre > Trust Centre Settings > Macro Settings, and ensuring the appropriate box is checked.
Security officers should communicate with all staff about the risks of macros and explain why they are being blocked.
This can be done through an email newsletter or a meeting presentation.
The IT department should monitor and maintain a list of users who have a business need to run macros, ensuring that these exceptions are documented and approved.
An IT security specialist should ensure antivirus scanning is enabled for macro files.
Microsoft Defender or another antivirus solution should be set up to automatically scan these macros for potential threats.
Keep it running
Enforce Office's "Block macros from the Internet" via GPO/Intune and test with MOTW-tagged files to confirm macros are blocked.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What are your current settings for macros in Microsoft Office applications from the internet?
Look at
Examine screenshots or exports of group policy settings within the Microsoft Office Trust Centre macro settings.
Good evidence
The export shows macros from the internet are set to be blocked and cannot be changed by users.
- Check 2 of 2What an auditor asks for
Ask for
How do you verify that only the necessary staff have access to macros?
Look at
Review a list of users with macro permissions and their documented business justification for requiring access.
Good evidence
The organisation maintains a current list of authorised users whose access is periodically reviewed.
Mappings
Closest match in ASD Information Security Manual: ISM-1488, Blocking internet-originating macros in Office files, which asks for the same thing.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1488.
E8-RM-ML1.2 requires Microsoft Office macros in files originating from the internet to be blocked to prevent internet-borne macro execution. ISM-1488 states the same requirement: blocking Microsoft Office macros in files originating from the internet. The scope and intent align closely, with both focused on the Mark-of-the-Web/internet-origin trust boundary for Office macro execution.
- ISM-1671Disable Office macros for users lacking a demonstrated business requirementPartially overlaps
This control partially overlaps ISM-1671.
E8-RM-ML1.2 requires Microsoft Office macros from internet-originating files to be blocked. ISM-1671 overlaps by requiring macros to be disabled for users without a demonstrated business requirement, which also reduces macro execution from common delivery channels, including the internet. However, while E8-RM-ML1.2 is source-based (internet-origin), ISM-1671 focuses on user/authorization-based control.
This control partially overlaps ISM-1672.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro content. E8-RM-ML1.2 blocks macros in files originating from the internet, reducing exposure to common phishing and drive-by macro payloads that scanning would otherwise need to detect. The overlap is macro malware mitigation, but E8-RM-ML1.2 is a source-based execution block whereas ISM-1672 is a scanning/detection setting that can apply more broadly.
This control partially overlaps ISM-1673.
ISM-1673 requires that Office macros are blocked from making Win32 API calls regardless of origin, limiting what macros can do if they run. E8-RM-ML1.2 blocks macros in files originating from the internet, reducing the likelihood of untrusted macros executing in the first place. E8-RM-ML1.2 is about trust/origin-based prevention, while ISM-1673 is about capability restriction for macros that may execute.
This control partially overlaps ISM-1674.
E8-RM-ML1.2 requires blocking Microsoft Office macros specifically when the file originates from the internet. ISM-1674 supports this by defining the broader allowed-execution model (only sandboxed, Trusted Location, or trusted signed macros may run), which is a common way to enforce macro restrictions. ISM-1674 is not limited to internet-origin files, but implementing it typically results in blocking internet-origin macros unless they meet the trusted execution criteria.
This control partially overlaps ISM-1675.
E8-RM-ML1.2 requires blocking macros in Microsoft Office files originating from the internet. ISM-1675 supports this by preventing users from enabling macros signed by an untrusted publisher via the Message Bar or Backstage View, reducing the chance that an internet-delivered macro can be run through user override. ISM-1675 focuses on publisher trust and user enablement pathways, not the internet-origin attribute itself.
This control depends on ISM-1489.
E8-RM-ML1.2 requires that internet-origin Microsoft Office macros are blocked. ISM-1489 supports this by preventing users from changing Office macro security settings, which helps ensure the internet-macro block cannot be weakened or bypassed by end users. ISM-1489 does not itself mandate blocking internet-origin macros, but it strengthens the durability and enforceability of E8-RM-ML1.2.
This control depends on ISM-1891.
E8-RM-ML1.2 requires internet-origin Microsoft Office macros to be blocked. ISM-1891 supports this by restricting the ability to enable macros signed with non-V3 signatures via the Message Bar or Backstage View, reducing risky macro enablement commonly associated with externally sourced documents. ISM-1891 is about signature strength/format rather than file origin, so it complements but does not duplicate E8-RM-ML1.2.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RM-ML1.2 requires Microsoft Office macros in files originating from the internet to be blocked, a macro setting for such a baseline.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML1.2 blocks Microsoft Office macros in files originating from the internet, a narrower control on which code can run.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.