ASD ISM 1487 Restrict write access to trusted locations to macro vetting users
What it says
Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly the privileged people who vet Microsoft Office macros for malicious code may add, change or remove files inside Trusted Locations. Everyone else, including ordinary users, gets read-only access.
Microsoft Office treats a Trusted Location as a safe folder: macros in files stored there run without the usual security checks and prompts. That makes the folder a powerful bypass. Whoever can put a file into it can effectively run a macro on every machine that trusts that folder. This control limits who holds that power. Only privileged human users whose job is to check that macros are free of malicious code may write to or modify content within a Trusted Location. Standard users, service accounts and automated processes should not be able to create, edit or delete anything there. Why it matters: if a normal user (or malware running as that user) can drop a document into a Trusted Location, an attacker can turn the organisation's own "safe" folder into a delivery channel for malicious macros that Office will run without warning. Restricting write access to the small group who actually vets macros means every file that lands in a Trusted Location has passed through a person accountable for checking it.
Free. Save your status, tasks and notes.
Why it matters
If write access to Trusted Locations is open to ordinary users or automated accounts, a phished user, a compromised workstation or a malicious insider can place a macro-enabled document into a folder where Office will run its macros without prompting or blocking. The macro vetting process is bypassed entirely, malware can spread to every user who trusts that location, and the organisation loses any assurance that Trusted Location content has been checked for malicious code.
How to implement
Have the desktop or endpoint team enumerate every Trusted Location configured in Office (from Group Policy, Intune or Trust Centre settings) and record each path, the host or share it lives on, and the current write permissions, so you know exactly which folders this control applies to.
Have the identity team create a dedicated security group (for example, Office-Macro-Vetting-Writers) whose only members are the named privileged human users responsible for checking macros for malicious code, and use this group as the sole source of write permissions on Trusted Locations.
Have the file server or endpoint administrators set NTFS and share permissions on each Trusted Location so that the macro vetting group has Modify, all other users have Read and Execute only, and inheritance from parent folders is broken so no broader write rights leak in.
Have the workstation build team enforce the same permissions on local Trusted Locations through Group Policy Preferences, Intune configuration or the standard image, so locally configured trusted folders cannot be written to by the logged-on standard user or by software running in that user's context.
Have the security team add Trusted Location write group membership to the privileged access review, and require that any change to the group or to the folder permissions goes through change management with sign-off from the macro vetting function owner.
Keep it running
Day to day, this control lives in the file system and share permissions of each configured Trusted Location, and in the membership of the group allowed to write there.
- Maintain a single, current inventory of every Trusted Location (local paths and network shares) and the security group that holds write access to each.
- Keep the write group small and made up of named, privileged human accounts whose role includes checking macros for malicious code. Do not add shared accounts, service accounts, scheduled jobs or deployment tooling to it.
- Grant everyone else read and execute only. A user who needs a vetted macro-enabled file simply opens it from the Trusted Location; they never need to save into it.
- When a macro vetting user leaves the role or the organisation, remove their write access as part of the offboarding or role-change process.
- When a new Trusted Location is created, apply the restricted write permissions before it is added to Office trust settings, so there is never a window where an open folder is trusted.
- Periodically compare the effective permissions on each Trusted Location against the inventory and fix any drift, such as inherited write rights from a parent folder or an "Everyone" or "Authenticated Users" entry.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the inventory of all Microsoft Office Trusted Locations and the group or accounts permitted to write to each.
Look at
Check that every trusted path configured in Office policy appears in the inventory and that each has a named write group listed against it.
Good evidence
One complete inventory exists, every configured Trusted Location is listed, and each maps to a single restricted group of macro vetting users.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the current membership of the group that holds write access to Trusted Locations.
Look at
Compare the members against the list of people whose role is to check macros for malicious code, and look for shared, service or generic accounts.
Good evidence
Membership is small, every member is a named privileged human user in the macro vetting role, and there are no service or shared accounts.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the effective permissions (share and file system) on a sample of Trusted Locations, including at least one local path and one network share.
Look at
Look at who has Write, Modify or Full Control, and whether Everyone, Authenticated Users or Domain Users have anything beyond Read and Execute.
Good evidence
Only the macro vetting group can write or modify; all other principals are read-only, and inheritance has not reintroduced broader rights.
- Check 4 of 5What an auditor asks for
Ask for
Ask a standard user to attempt to save or edit a file inside a Trusted Location while you observe.
Look at
Watch whether the save is refused by the operating system and whether the user has any alternative path, such as a mapped drive or sync client, that writes to the same folder.
Good evidence
The write is denied for the standard user by every route, and only a member of the macro vetting group can complete it.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the most recent access review and change records covering Trusted Location permissions and the write group.
Look at
Check that membership and permission changes were requested, approved by the macro vetting function owner and reviewed within the organisation's review cycle.
Good evidence
Reviews are on schedule, each change has an approval, and departed or role-changed users were removed promptly.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.3, Only privileged users can modify content in Trusted Locations, which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-1487 requires that only privileged macro-vetting users can write to and modify Microsoft Office Trusted Locations, with other users effectively limited to read-only access. ISO/IEC 27001:2022 Annex A 5.15 establishes the broader requirement to define and implement access control rules and procedures based on business and security needs, under which this Trusted Locations restriction would be one concrete rule. Annex A 5.15 spans all assets and access scenarios, whereas ISM-1487 is a specific, technology- and threat-focused access rule for macro-related risk.
This control partially meets A.5.18.
ISM-1487 requires organisations to tightly control and limit write/modify permissions on Microsoft Office Trusted Locations to privileged macro-vetting users. ISO/IEC 27001:2022 Annex A 5.18 is broader, requiring provisioning, review, modification and removal of access rights to information assets in line with access control policy-Trusted Locations permissions are one example of such access rights. Annex A 5.18 covers the full access-rights management lifecycle across assets, while ISM-1487 specifies a particular access restriction for a common malware ingress mechanism.
This control partially meets A.8.3.
ISM-1487 requires restricting write access to Office Trusted Locations so only privileged macro-vetting users can add or change content there. ISO/IEC 27001:2022 Annex A 8.3 is a general control requiring access to information and assets to be restricted according to the organisation's access control policy, which would include restricting write permissions on sensitive directories or configuration locations. Annex A 8.3 applies broadly to all information and assets, whereas ISM-1487 is a specific implementation targeting macro execution trust boundaries.
This control partially overlaps A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed, including limiting who can perform high-impact administrative actions. ISM-1487 relates by restricting the ability to write/modify macro Trusted Locations to privileged users responsible for validating macros, which is a privileged capability within Microsoft Office configuration. ISM-1487 is focused on macro security and content control in a specific feature set, whereas Annex A 8.2 covers privileged access rights across all systems and administrative functions.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RM-ML3.3.
E8-RM-ML3.3 requires only privileged users who verify Microsoft Office macros to modify content within Trusted Locations. ISM-1487 imposes the same restriction on modifying Trusted Locations, linking permission to users responsible for macro checking, with both controls sharing scope and role constraints.
This control supports E8-RM-ML3.1.
ISM-1487 mandates that only privileged, authorised macro reviewers can modify content within Microsoft Office Trusted Locations. E8-RM-ML3.1 limits macro execution to trusted mechanisms, such as Trusted Locations, and ISM-1487 reduces the chance an unauthorised user can place a malicious macro there to enable execution. ISM-1487 governs modification rights of the location, whereas E8-RM-ML3.1 concerns execution conditions.
This control depends on E8-RM-ML3.2.
E8-RM-ML3.2 requires macros to be checked for malicious code before they are signed or placed in Trusted Locations. ISM-1487 supports this by restricting who can modify content in Trusted Locations to privileged users responsible for performing the malicious-code checks, reducing the risk of unreviewed macros being inserted or altered after review. The ISM control focuses on write/modify access governance, while the primary focuses on the pre-trust verification activity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.