Essential Eight RM-ML3.3 Only privileged users can modify content in Trusted Locations
What it says
Only privileged users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that only specific users can edit trusted macro locations to prevent malicious code.
This control ensures that only certain trusted people can change sensitive macro settings in Microsoft Office. These settings are special locations where Office macros can run. If unqualified people change these settings, it could allow harmful code to be run unknowingly, which could compromise your entire system.
Free. Save your status, tasks and notes.
Why it matters
If unauthorised users can modify Trusted Locations, malicious macros may execute without warning, compromising systems and data integrity.
How to implement
IT team should identify who needs access to Trusted Locations by reviewing current user roles and responsibilities.
System administrator should restrict write access to Trusted Locations to these identified privileged users using group policy settings.
Security officer should train privileged users on securely checking macros for malicious code before placing in Trusted Locations.
System administrator should regularly review and update the list of users with access to Trusted Locations to ensure it's current.
IT team should implement logging for changes to Trusted Locations to track who modified them and what changes were made.
Security officer should establish a procedure for approving macro code to be placed in Trusted Locations that includes security checks.
Keep it running
Restrict Trusted Locations to privileged macro reviewers only; audit NTFS/share ACLs and monitor changes so non-privileged users cannot write content there.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Who is allowed to modify Trusted Locations in Microsoft Office?
Look at
Check the list of users with permissions to modify Trusted Locations.
Good evidence
Only those trained and authorised by management are listed, with documented responsibilities.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure that macros in Trusted Locations are safe?
Look at
Review the procedures or documentation for macro code review before approval.
Good evidence
There is a step-by-step procedure requiring a security scan before a macro is approved for Trusted Locations.
Mappings
Closest match in ASD Information Security Manual: ISM-1487, Restrict write access to trusted locations to macro vetting users, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.18.
E8-RM-ML3.3 involves controlling who can modify content in trusted macro locations. Annex A 5.18 encompasses provisioning, reviewing, and modifying access rights to information assets according to an access control policy. The primary control presents a specific use case of rights assignment, whereas Annex A 5.18 is broader and includes the complete access-right lifecycle.
This control partially meets A.8.2.
E8-RM-ML3.3 mandates restrictions on who can modify Microsoft Office Trusted Locations, specifically allowing only privileged users who verify macros. Annex A 8.2 calls for the allocation and management of privileged access across the organisation, making E8-RM-ML3.3 a more specific application within a broader privileged access management framework.
This control partially meets A.8.3.
E8-RM-ML3.3 restricts modification rights to Trusted Locations to authorised privileged users for macro-related content. Annex A 8.3 involves general restrictions on access to assets per access control policy, with E8-RM-ML3.3 being a specific instance for one high-risk asset class concerning write/modify access.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1487.
E8-RM-ML3.3 requires only privileged users who verify Microsoft Office macros to modify content within Trusted Locations. ISM-1487 imposes the same restriction on modifying Trusted Locations, linking permission to users responsible for macro checking, with both controls sharing scope and role constraints.
This control partially overlaps ISM-1392.
ISM-1392 requires restricting who can modify files/folders covered by application control path rules. E8-RM-ML3.3 similarly restricts who can write to and modify content, but it is scoped specifically to Microsoft Office macro Trusted Locations and to privileged users who perform macro checking. ISM-1392 is broader across approved files/folders under path rules, while E8-RM-ML3.3 is narrower to a particular application feature and threat scenario.
This control partially overlaps ISM-1508.
ISM-1508 requires that privileged access is limited to what is necessary for duties on relevant systems and resources. E8-RM-ML3.3 maps to this by restricting write/modify permissions to Trusted Locations to only those privileged users with defined macro-checking responsibility. E8-RM-ML3.3 is a very specific application-control scenario, while ISM-1508 is a general least-privilege control across all resources.
- ISM-1671Disable Office macros for users lacking a demonstrated business requirementPartially overlaps
This control partially overlaps ISM-1671.
ISM-1671 requires macros to be disabled for users unless they can demonstrate a business need. E8-RM-ML3.3 overlaps by focusing on where macros are permitted to run (Trusted Locations) and ensuring only vetted, privileged maintainers can place or modify macro-enabled content there. ISM-1671 is primarily about user-level allowance/denial, whereas E8-RM-ML3.3 is about controlling the authorised distribution points for macro code when macros are required.
This control partially overlaps ISM-1890.
E8-RM-ML3.3 restricts Trusted Location modifications to privileged macro verification users to prevent unauthorised placement. ISM-1890 requires verification of macros for malicious code before digital signing or location placement, focusing on validation. They overlap in macro processes, with E8-RM-ML3.3 centred on access control and ISM-1890 on pre-placement assurance.
This control supports ISM-1674.
ISM-1674 requires that only macros from a sandbox, Trusted Location, or trusted publisher signature can execute. E8-RM-ML3.3 supports this by restricting who can write or modify content in Trusted Locations, helping ensure the Trusted Location pathway in ISM-1674 cannot be abused by unprivileged users. ISM-1674 defines the permitted execution sources, while E8-RM-ML3.3 strengthens governance and integrity of one of those sources (Trusted Locations).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML3.3 lets only the privileged users who check Microsoft Office macros for malicious code write to and modify content in Trusted Locations, protecting the approved set of macros.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.