Essential Eight RM-ML3.5 Block enabling of non-V3 signed Microsoft Office macros via Message Bar
What it says
Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent enabling of macros not signed with V3 signatures using standard Office UI controls.
This control is about making sure that only trustworthy macros in Microsoft Office can be turned on. Macros are small programs that can automate tasks in Office applications like Word and Excel. If they're not properly checked, they could be used by attackers to run harmful software on your computers. By blocking macros that aren't signed with a trusted version of a digital signature, we reduce the risk of this happening.
Free. Save your status, tasks and notes.
Why it matters
If users can enable non‑V3 signed Office macros via the Message Bar/Backstage, malware may run and compromise devices and data.
How to implement
IT team should ensure that only macros signed with a V3 digital signature can be enabled.
This can be done by configuring Microsoft Office settings to enforce this rule.
System administrators should regularly check the digital signatures used on macros within their Office applications.
This involves verifying that the signatures are V3 and come from a trusted source.
Security officers should train employees about the risks of enabling macros and set policies that macros should only be enabled if they are necessary and verified.
IT personnel should update policy settings in the Office Trust Centre across all user computers to automatically block macros that don't meet the signature requirements.
Keep it running
Confirm Group Policy blocks enabling non‑V3 signed macros via Message Bar/Backstage, and routinely test with sample files.
Evidence and audit
- Check 1 of 1What an auditor asks for
Ask for
Are there procedures in place to restrict enabling of macros without a V3 signature?
Look at
Examine the Office Trust Centre settings in user profiles to check if the policy blocking non-V3 signed macros is enabled.
Good evidence
The settings should show that only V3 signed macros can be enabled through the Message Bar or Backstage View.
Mappings
Closest match in ASD Information Security Manual: ISM-1891, Restrict non-V3 signed macros in Microsoft Office, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1891.
ISM-1891 requires that Microsoft Office macros signed with signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View. E8-RM-ML3.5 states the same technical restriction using the same Office enablement pathways. The scope and implementation intent are effectively identical, so meeting one would largely satisfy the other.
This control partially overlaps ISM-1675.
E8-RM-ML3.5 blocks users from enabling macros via Office UI when the macro is not signed with a V3 signature. ISM-1675 blocks users from enabling macros via the same UI when the publisher is untrusted, regardless of signature version. They intersect on preventing user enablement of risky macros via Message Bar/Backstage View, but each uses a different trust criterion (V3 signature format vs trusted publisher status).
This control depends on ISM-1489.
E8-RM-ML3.5 requires enforcing a policy that users cannot enable non‑V3 signed Office macros via the Message Bar or Backstage View. ISM-1489 ensures Microsoft Office macro security settings cannot be changed by users, which helps prevent users from weakening or bypassing the E8-RM-ML3.5 enforcement through local configuration changes. While ISM-1489 does not itself define the V3 signature restriction, it is a prerequisite control to keep that restriction reliably enforced in end-user environments.
This control depends on ISM-1674.
ISM-1674 requires that only macros that are sandboxed, from Trusted Locations, or signed by a trusted publisher are allowed to execute. E8-RM-ML3.5 supports this by restricting the ability to enable macros with non-V3 signatures via common Office enablement prompts, reducing acceptance of weaker or non-compliant signing. ISM-1674 focuses on the allowed execution conditions, whereas E8-RM-ML3.5 specifically constrains one enablement mechanism and signature type quality.
This control depends on ISM-1823.
ISM-1823 requires centrally enforced Office productivity suite security settings that users cannot change. E8-RM-ML3.5 requires blocking the enabling of non‑V3 signed Microsoft Office macros via the Message Bar/Backstage View, which is typically implemented via centrally enforced Office policy settings. ISM-1823 supports E8-RM-ML3.5 by ensuring users cannot override or relax the macro-enablement controls once configured.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RM-ML3.5 is one baseline setting: Office macros with non-V3 digital signatures cannot be enabled via the Message Bar or Backstage View.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML3.5 ensures Microsoft Office macros signed with anything other than V3 signatures cannot be enabled via the Message Bar or Backstage View, a narrower case of that rule.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.