Essential Eight RM-ML3.2 Check Microsoft Office macros for malicious code before signing or trusting
What it says
Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Office macros are safe from malicious code before trusting or signing.
This control means making sure that any macros (small programs) in Microsoft Office files are not harmful before you decide to trust them or give them special permissions. It's important because malicious macros can act like hidden doors for hackers to enter your system, potentially causing serious damage and data breaches.
Free. Save your status, tasks and notes.
Why it matters
Unchecked Office macros can contain malicious code that runs when trusted, enabling malware execution and potential data compromise.
How to implement
System Administrator should identify all users who have a business need to use macros and ensure those users are accounted for in an approved list.
IT Team should configure security settings to automatically check and block any macros unless they are confirmed safe through antivirus scanning and have proper digital signatures.
Security Officer should regularly update and review the Trusted Publisher list in Microsoft Office to ensure only trusted sources are allowed to execute macros.
System Administrator should create a process for checking every macro that needs to be used with detailed steps on how to verify it does not contain malicious code before it gets any special permissions.
Keep it running
Review and scan Office macro code before digital signing or adding to Trusted Locations; tightly control who can sign and audit signed macros.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How do you ensure only trusted macros are used in the organisation?
Look at
Check the list of Microsoft Office settings that show macro security configurations.
Good evidence
The organisation uses antivirus scanning and trusted publisher lists, and regularly checks this list for updates.
- Check 2 of 3What an auditor asks for
Ask for
Are there specific records for users with authorisation to use macros?
Look at
Review records or logs showing granted permissions and approvals for macro use.
Good evidence
There is a documented list of users with business justifications and permissions updated regularly.
- Check 3 of 3What an auditor asks for
Ask for
How is the digital signature of macros verified?
Look at
Examine the documented process for macro validation and digital signature checking.
Good evidence
There is a detailed procedure to verify macros by digital signatures before being deemed trustworthy.
Mappings
Closest match in ASD Information Security Manual: ISM-1890, Ensure macros are free of malicious code, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1890.
E8-RM-ML3.2 requires Microsoft Office macros to be checked to ensure they are free of malicious code before they are digitally signed or placed within Trusted Locations. ISM-1890 states the same requirement with the same trigger points (signing or Trusted Locations) and the same security intent (prevent trusting malicious macros). Implementing either control would largely satisfy the other because their scope and depth are effectively identical.
This control partially overlaps ISM-1796.
ISM-1796 requires executable files to be digitally signed using a certificate with a verifiable chain of trust as part of software development. E8-RM-ML3.2 relates by requiring Microsoft Office macros (a form of executable content) to be checked for malicious code before they are digitally signed or trusted. The overlap is on signing as an integrity/authenticity control, but E8-RM-ML3.2 is specific to macro safety checks and trust decisions, while ISM-1796 is broader and focuses on trusted signing for executable software generally (not malware review).
This control supports ISM-1487.
E8-RM-ML3.2 requires macros to be checked for malicious code before they are signed or placed in Trusted Locations. ISM-1487 supports this by restricting who can modify content in Trusted Locations to privileged users responsible for performing the malicious-code checks, reducing the risk of unreviewed macros being inserted or altered after review. The ISM control focuses on write/modify access governance, while the primary focuses on the pre-trust verification activity.
This control supports ISM-1672.
E8-RM-ML3.2 requires macros to be checked to ensure they are free of malicious code before being signed or trusted via Trusted Locations. ISM-1672 supports this by enabling antivirus scanning for Office macros, which is a key technical mechanism that can be used during the checking step. ISM-1672 is about configuring a detection capability, while E8-RM-ML3.2 is about the governance/assurance decision to only sign or trust macros after verification.
This control supports ISM-1674.
ISM-1674 requires that only macros from sandboxed environments, Trusted Locations, or signed by a trusted publisher are allowed to execute. E8-RM-ML3.2 supports this by requiring macros be checked for malicious code before being signed or placed into Trusted Locations, reducing the risk that "allowed" macros are actually malicious. ISM-1674 is primarily an execution control, while E8-RM-ML3.2 is a pre-approval assurance activity for the same trust pathways.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML3.2 requires Microsoft Office macros to be checked for malicious code before being digitally signed or placed in Trusted Locations, a verification step for macros.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.