Essential Eight RM-ML3.6 Validate list of trusted publishers in Microsoft Office annually
What it says
Microsoft Office's list of trusted publishers is validated on an annual or more frequent basis.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check and confirm trusted publishers in Microsoft Office to prevent unauthorised macro use.
This control is about checking the list of trusted publishers in Microsoft Office every year. It's important because if you don't, someone might sneak in malicious macros that can harm your computer or steal your information.
Free. Save your status, tasks and notes.
Why it matters
If trusted publishers are not revalidated, malicious Office macros may run, causing data breaches and financial loss.
How to implement
The IT team should create a list of all current trusted publishers in Microsoft Office by accessing the Trust Centre settings in Office applications.
The system administrator should schedule an annual review of the trusted publishers' list to ensure only authorised publishers are included.
The security officer should cross-check the list against known trusted and approved publishers within your organisation or industry standards to confirm validity.
The IT team should remove any publishers that are no longer trusted or necessary by accessing the Trust Centre and editing the list accordingly.
The policy officer should document the review process and any changes made in a formal report to maintain records for compliance purposes.
Keep it running
Review Office trusted publishers at least annually; remove stale certificates and confirm publisher legitimacy with vendors.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show me how often the list of trusted publishers in Microsoft Office is reviewed?
Look at
Examine the schedule or calendar entry for the annual review of trusted publishers.
Good evidence
There is a documented schedule showing an annual review with evidence of who performed it and when.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation determine which publishers remain trusted?
Look at
Review the documentation that lists criteria or guidelines for assessing trusted publishers.
Good evidence
There is a clear guideline approved by the security team on how to evaluate trusted publishers.
Mappings
Closest match in ASD Information Security Manual: ISM-1676, Validate Microsoft Office trusted publishers list at least annually, which asks for the same thing.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1676.
ISM-1676 requires Microsoft Office's list of trusted publishers to be validated at least annually. E8-RM-ML3.6 states the same requirement with the same frequency and the same Microsoft Office trusted publisher list focus. Implementing either control would largely satisfy the other as they are aligned in scope and intent.
This control partially meets ISM-1582.
E8-RM-ML3.6 requires an annual validation of Microsoft Office's trusted publishers list to ensure only approved macro signers remain trusted. ISM-1582 requires validation of application control rulesets annually or more frequently, which is a broader governance activity covering multiple rule types and applications. E8-RM-ML3.6 is a specific instance of the broader 'validate rulesets' concept applied to Office trusted publishers.
This control supports ISM-1674.
ISM-1674 requires that macro execution is limited to sandboxed macros, Trusted Locations, or those signed by a trusted publisher. E8-RM-ML3.6 supports this by ensuring the organisation's list of trusted publishers remains accurate and current through regular validation, which directly affects what is considered "trusted" under ISM-1674. ISM-1674 sets the rule for execution; E8-RM-ML3.6 governs ongoing maintenance of trust decisions.
This control supports ISM-1675.
E8-RM-ML3.6 requires organisations to annually validate the Microsoft Office trusted publishers list so trust decisions about macro signers remain current. ISM-1675 prevents users from enabling macros signed by an untrusted publisher via Office UI pathways, which relies on the trusted/untrusted publisher boundary being accurate. Validating the trusted publishers list (E8-RM-ML3.6) strengthens ISM-1675 by reducing the chance a malicious or obsolete publisher remains incorrectly trusted.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.