Essential Eight RM-ML3.1 Restrict Microsoft Office macros to only trusted or sandboxed environments
What it says
Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAllow only macros from trusted locations, sandboxes, or signed by trusted publishers.
This control is about making sure that macros in Microsoft Office documents, like Word or Excel, only run if we know they're safe. Macros can automatically execute tasks and, if not controlled, they can be used by hackers to run harmful code on your computer, leading to data breaches or loss.
Free. Save your status, tasks and notes.
Why it matters
Unchecked Office macros can deliver malware, enabling data theft and account compromise, disrupting business operations and causing financial loss.
How to implement
The IT team should review current group policy settings to ensure macros in Microsoft Office are restricted to running only from trusted locations or if digitally signed by trusted publishers.
System administrators should configure Microsoft Office applications to block macros in files that come from the internet to prevent potential threats from external sources.
Security officers should ensure that only verified users with a valid business need have access to trusted locations where macros are allowed to run.
The IT team should enable and regularly update antivirus scanning for macros via Microsoft Defender or another antivirus product to check for harmful code.
Security administrators should conduct regular training sessions with staff to raise awareness about the risks of untrustworthy macros and the procedures in place.
Keep it running
Review and minimise Trusted Locations, validate trusted publishers' certificates, and ensure macros run only in approved sandboxes; remove stale exceptions.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Do you have a list of users authorised to use macros and their business requirements?
Look at
Review the documentation detailing business reasons for each user allowed to use macros.
Good evidence
There is a list of authorised users with documented business requirements aligned with macro permissions.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure macros from the internet are blocked?
Look at
Examine group policy settings and Microsoft Office Trust Centre configurations.
Good evidence
The settings confirm that macros from internet sources are blocked, and the system automatically enforces these restrictions.
Mappings
Closest match in ASD Information Security Manual: ISM-1674, Ensuring secure execution of Microsoft Office macros, which asks for the same thing.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1674.
ISM-1674 requires that only Microsoft Office macros running in a sandbox, from a Trusted Location, or digitally signed by a trusted publisher are allowed to execute. E8-RM-ML3.1 states the same execution gating conditions for macros (sandboxed, Trusted Location, or trusted digital signature). Both controls have effectively identical scope and intent around preventing unsafe macro execution.
This control partially meets ISM-1488.
ISM-1488 requires that Microsoft Office macros in files originating from the internet are blocked. E8-RM-ML3.1 is broader because it restricts macro execution to only trusted locations, sandboxed environments, or trusted digital signatures (regardless of origin), which would include blocking untrusted internet-sourced macros. ISM-1488 is one specific hardening condition within E8-RM-ML3.1's wider macro trust model.
- ISM-1671Disable Office macros for users lacking a demonstrated business requirementPartially overlaps
This control partially overlaps ISM-1671.
ISM-1671 requires Microsoft Office macros to be disabled for users unless they have a demonstrated business requirement. E8-RM-ML3.1 complements this by defining conditions for safe macro execution (sandboxed, Trusted Location, or trusted publisher), aligning with how organisations safely enable macros for authorised users. ISM-1671 is about user permissions for macros, whereas E8-RM-ML3.1 is about controlling macro execution.
This control partially overlaps ISM-1672.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to identify malicious macros at runtime or on access. E8-RM-ML3.1 restricts macro execution to sandboxed environments, Trusted Locations, or digitally signed macros from trusted publishers, thereby controlling where and when macros can run. Both reduce macro malware risk, but E8-RM-ML3.1 focuses on execution trust boundaries while ISM-1672 focuses on malware detection via scanning.
This control partially overlaps ISM-1673.
ISM-1673 requires that Office macros are blocked from making Win32 API calls, limiting macro capability even when execution is permitted. E8-RM-ML3.1 restricts macro execution to sandboxed environments, Trusted Locations, or trusted signatures, controlling where and under what trust conditions macros can run. Both reduce macro-driven compromise, but E8-RM-ML3.1 is about execution allow-listing/trust boundaries while ISM-1673 is a specific runtime restriction on API access.
This control supports ISM-1675.
E8-RM-ML3.1 permits only trusted/sandboxed/signed Office macros to execute. ISM-1675 supports E8-RM-ML3.1 by preventing users from enabling macros signed by untrusted publishers through Office prompts, reducing the risk of bypassing macro trust decisions. E8-RM-ML3.1 establishes the allow rule, while ISM-1675 strengthens user interaction paths to prevent rule circumvention.
This control supports ISM-1891.
E8-RM-ML3.1 enforces macro execution only under trusted conditions (sandbox, Trusted Location, or trusted publisher signature). ISM-1891 supports this by restricting macro enabling with non-V3 signatures via the Office UI, thus strengthening the signed macro pathway by limiting weaker signature types. E8-RM-ML3.1 is signature-agnostic, whereas ISM-1891 imposes a stricter technical constraint on signatures.
This control depends on ISM-1487.
ISM-1487 mandates that only privileged, authorised macro reviewers can modify content within Microsoft Office Trusted Locations. E8-RM-ML3.1 limits macro execution to trusted mechanisms, such as Trusted Locations, and ISM-1487 reduces the chance an unauthorised user can place a malicious macro there to enable execution. ISM-1487 governs modification rights of the location, whereas E8-RM-ML3.1 concerns execution conditions.
This control depends on ISM-1676.
ISM-1676 requires organisations to periodically validate which publishers are trusted in Microsoft Office. E8-RM-ML3.1 relies on the correctness of that trust decision because it allows macro execution when macros are signed by a trusted publisher (or are in a Trusted Location/sandbox). ISM-1676 strengthens E8-RM-ML3.1 by reducing the risk that an inappropriate or outdated publisher remains trusted and therefore permitted to run macros.
This control depends on ISM-1890.
E8-RM-ML3.1 requires macros to only execute if sandboxed, in Trusted Locations, or signed by a trusted publisher. ISM-1890 supports E8-RM-ML3.1 by requiring macros to be checked for malicious code before signing or placement in Trusted Locations, enhancing the trustworthiness of these pathways. E8-RM-ML3.1 enforces execution conditions, whereas ISM-1890 ensures macro safety prior to fulfilling those conditions.
This control depends on ISM-2050.
E8-RM-ML3.1 requires macros to execute only when digitally signed by a trusted publisher (or from a Trusted Location/sandbox). ISM-2050 supports E8-RM-ML3.1 by enforcing robust certificate chain and revocation checks for digital signatures, ensuring the 'trusted publisher' decision is technically sound. E8-RM-ML3.1 outlines macro execution policy, while ISM-2050 defines cryptographic validation practices that bolster signature trustworthiness.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML3.1 lets Microsoft Office macros execute only if sandboxed, in a Trusted Location or digitally signed by a trusted publisher, a narrower restriction on which macros can run.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.