Essential Eight RM-ML1.3 Enable antivirus scanning for Microsoft Office macros
What it says
Microsoft Office macro antivirus scanning is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure antivirus scanning is active for macros in Microsoft Office documents.
This control ensures that any macros in Microsoft Office documents are scanned by antivirus software before they run. Without this control, harmful code could execute, leading to data theft or damage, as many viruses are hidden in macros.
Free. Save your status, tasks and notes.
Why it matters
Without Office macro antivirus scanning, malicious macros may run and lead to compromise, data loss, or disruption.
How to implement
The IT team should ensure antivirus software is installed on all computers that use Microsoft Office.
This is necessary to scan and catch harmful macros.
System administrators should configure the antivirus software to automatically scan all Microsoft Office documents, especially those containing macros, to check for viruses.
The security officer should verify that Microsoft Defender or another antivirus tool is set up to scan macros as soon as a document is opened.
IT team should regularly update the antivirus software so it can recognise the latest threats that could be hidden in macros.
System administrators should ensure that macro virus scanning settings are enforced via group policies to maintain consistency across all user devices.
Keep it running
Regularly update antivirus signatures and confirm Microsoft Office macro scanning is enabled to detect new macro-based threats.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Is antivirus scanning enabled for Microsoft Office macros?
Look at
Check antivirus configuration settings in the centralised management console.
Good evidence
Antivirus settings show scanning is enabled for Office macros, and policies ensure it applies to all users.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure antivirus definitions are up to date?
Look at
Review logs or update schedules showing antivirus definitions are frequently updated.
Good evidence
Logs indicate daily update checks, and a recent antivirus update was applied successfully.
Mappings
Closest match in ASD Information Security Manual: ISM-1672, Enable antivirus scanning for Office macros, which asks for the same thing.
ASD Information Security Manual: 2 mappings
This control is equivalent to ISM-1672.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled. E8-RM-ML1.3 specifies the same configuration outcome-enabling antivirus scanning for Microsoft Office macros. Both controls are aligned in scope and intent, and implementing either would largely satisfy the other.
This control depends on ISM-1417.
ISM-1417 requires comprehensive antivirus on workstations and servers, including high-level detection settings, daily signature updates, ransomware protection, and regular scanning of fixed and removable media. E8-RM-ML1.3 specifically requires enabling antivirus scanning for Microsoft Office macros, which is a concrete malware detection use case that would typically be delivered via the endpoint antivirus capability mandated by ISM-1417. ISM-1417 is broader because it covers whole-of-system antivirus configuration and scanning beyond Office macro content.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-RM-ML1.3 requires Microsoft Office macro antivirus scanning to be enabled, one specific application setting a deployed baseline would apply.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML1.3 requires Microsoft Office macro antivirus scanning to be enabled, a supporting check on macro code.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.