Skip to content
arrow_back
E8-RM-ML1.3
search account_circle
boltASD Essential Eight

Essential Eight RM-ML1.3Enable antivirus scanning for Microsoft Office macros

Official control statement

Microsoft Office macro antivirus scanning is enabled.
boltASD Essential EightE8-RM-ML1.3

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure antivirus scanning is active for macros in Microsoft Office documents.

ML1Essential EightConfigure macro settings
Control Stack classificationPreventativeMalware protectionOffice macros
record_voice_over

What this means in practice

This control ensures that any macros in Microsoft Office documents are scanned by antivirus software before they run. Without this control, harmful code could execute, leading to data theft or damage, as many viruses are hidden in macros.

Framework

ASD Essential Eight

Control effect (Control Stack)

Preventative

E8 mitigation strategy

Configure macro settings

Classifications

N/A

Official last update

N/A

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML1

priority_high

Why it matters

Without Office macro antivirus scanning, malicious macros may run and lead to compromise, data loss, or disruption.

settings

Operational notes

Regularly update antivirus signatures and confirm Microsoft Office macro scanning is enabled to detect new macro-based threats.

build

Implementation tips

  • The IT team should ensure antivirus software is installed on all computers that use Microsoft Office. This is necessary to scan and catch harmful macros.
  • System administrators should configure the antivirus software to automatically scan all Microsoft Office documents, especially those containing macros, to check for viruses.
  • The security officer should verify that Microsoft Defender or another antivirus tool is set up to scan macros as soon as a document is opened.
  • IT team should regularly update the antivirus software so it can recognise the latest threats that could be hidden in macros.
  • System administrators should ensure that macro virus scanning settings are enforced via group policies to maintain consistency across all user devices.
fact_check

Audit / evidence tips

  • AskIs antivirus scanning enabled for Microsoft Office macros?
  • Look atCheck antivirus configuration settings in the centralised management console
  • GoodAntivirus settings show scanning is enabled for Office macros, and policies ensure it applies to all users
  • AskHow do you ensure antivirus definitions are up to date?
  • Look atReview logs or update schedules showing antivirus definitions are frequently updated
  • GoodLogs indicate daily update checks, and a recent antivirus update was applied successfully
link

Cross-framework mappings

How E8-RM-ML1.3 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ASD ISM

ControlNotesDetails
equalEquivalent(1)expand_less
ISM-1672ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled
extensionDepends on(1)expand_less
ISM-1417ISM-1417 requires comprehensive antivirus on workstations and servers, including high-level detection settings, daily signature updates, ...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Related Essential 8 controls in Configure macro settings

E8-RM-ML3.6
Validate list of trusted publishers in Microsoft Office annually
E8-RM-ML1.1
Disable Microsoft Office macros for users without a business need
E8-RM-ML1.2
Block Microsoft Office macros from the internet
E8-RM-ML1.4
Prevent users from changing Microsoft Office macro security settings
E8-RM-ML2.1
Microsoft Office macros are blocked from making Win32 API calls
E8-RM-ML3.1
Restrict Microsoft Office macros to only trusted or sandboxed environments

See all Configure macro settings controls, or browse the full ASD Essential Eight library.

Mapping detail

Mapping

Direction

Controls