Skip to content
Configure macro settings
Essential EightE8-RM-ML3.4

Essential Eight RM-ML3.4 Untrusted publisher macros cannot be enabled via Message Bar or Backstage View

What it says

Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Block untrusted Microsoft Office macros from being enabled using standard interface warnings.

This control is about making sure that untrusted macros in Microsoft Office can't be turned on through the usual ways users interact with the software. Macros can be tiny programs inside Office documents, which, if untrusted, might run harmful commands that could steal data or damage systems. Without this control, your organisation is at risk of letting harmful code run freely through seemingly harmless documents.

Why it matters

Allowing macros from untrusted publishers to be enabled can lead to malicious code execution via Office documents, causing compromise or data loss.

How to implement

  1. IT team: Identify all computers that have Microsoft Office installations.

    Ensure the security settings prevent enabling untrusted macros from the Message Bar or Backstage View.

  2. System administrator: Configure Microsoft Office Group Policy settings to block macros from untrusted publishers, so that users can't enable them without deliberate IT intervention.

  3. Security officer: Review the list of approved trusted publishers regularly and ensure it's up to date, verifying that only necessary and known publishers are trusted.

  4. IT support: Educate staff on the dangers of enabling macros from unknown sources, emphasising that they should report any suspicious documents rather than enabling their content.

Keep it running

Use Office GPO/Intune to block enabling macros from untrusted publishers via Message Bar/Backstage View, and regularly test Office prompt behaviour after updates.

Evidence and audit

  1. Check 1 of 2What an auditor asks for

    Ask for

    How do you prevent users from enabling macros from untrusted publishers?

    Look at

    Check the Group Policy settings on several computers to ensure the macro settings are properly configured as per organisational policy.

    Good evidence

    The Group Policy should show that untrusted macros cannot be enabled, and a report should indicate when the policy was last validated.

  2. Check 2 of 2What an auditor asks for

    Ask for

    What process is in place to maintain and review the list of trusted publishers?

    Look at

    Review documentation that shows the regular checks and updates on the trusted publisher list.

    Good evidence

    The organisation should present a recent review log, indicating the date and outcomes of their trusted publisher list assessment.

Mappings

Closest match in ASD Information Security Manual: ISM-1675, Prevent enabling untrusted Microsoft Office macros, which asks for the same thing.

ASD ISM

ASD Information Security Manual: 5 mappings

  • ISM-1675Prevent enabling untrusted Microsoft Office macrosEquivalent
  • ISM-1674Ensuring secure execution of Microsoft Office macrosPartially meets
  • ISM-1891Restrict non-V3 signed macros in Microsoft OfficePartially overlaps
  • ISM-1489Lock Microsoft Office macro security settings against user changesDepends on
  • ISM-1676Validate Microsoft Office trusted publishers list at least annuallyDepends on
ASD Essentials

ASD Essentials for enterprise IT: 2 mappings

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.