ASD ISM 1488 Blocking internet-originating macros in Office files
What it says
Microsoft Office macros in files originating from the internet are blocked.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMicrosoft Office blocks macros from files downloaded from the internet to enhance security.
Blocking macros from office files downloaded from the internet is like ensuring your door has a peephole before letting someone in. Macros can carry harmful code that might damage your computer or steal information. This control protects your systems from getting infected by bad software hiding in documents from the web.
Free. Save your status, tasks and notes.
Why it matters
Allowing internet-originating Office macros can enable malware execution, leading to system compromise and data loss; blocking reduces this risk.
How to implement
IT Team should verify Microsoft Office settings: Check the settings in Microsoft Office applications to ensure that macros from documents originating online are blocked.
This can be done by accessing the macro settings in each Office application and ensuring internet-based documents have macros disabled by default.
Office Manager should train employees: Educate staff about the dangers of enabling macros in files from unknown sources.
Conduct a training session showing how to recognise alerts about macros and why they should avoid enabling them unless they are absolutely sure of the document's safety.
IT Team should apply group policies: Use group policy settings to enforce a rule across all company computers that block macros from internet files.
This involves configuring Group Policy Objects (GPOs) to apply the macro-blocking setting within your network.
System Administrator should update security software: Regularly confirm that security software is up to date to catch threats contained within macros.
This can involve setting automatic updates to ensure the most current protections are in place.
Office Manager should create a response plan: Develop a simple, easy-to-follow guide for staff on what to do if they suspect opening a risky macro might have happened.
Include steps like disconnecting from the internet and contacting IT support immediately.
Keep it running
Enforce Office policy to block macros in internet-sourced files (MOTW) via GPO/Intune, and routinely test with a MOTW-marked sample.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The macro settings configuration documentation: Request the document or screenshot showing the macro security settings in Microsoft Office.
Look at
The settings to confirm that macros from online sources are blocked by default.
Good evidence
Will show the specific settings checked to disable macros from untrusted locations.
- Check 2 of 5What an auditor asks for
Ask for
Training records on macro security.
Look at
Attendance logs or training materials that cover how employees are informed about the risks of macros and proper handling procedures. Good evidence includes a dated log of attendees and key points discussed during the training.
- Check 3 of 5What an auditor asks for
Ask for
Group policy settings: Request documentation or demonstration of the Group Policy Objects (GPOs) used to enforce macro-blocking. Look to see that policies are currently active and targeting relevant devices. A solid answer will present GPO details showing that these are applied and effective.
- Check 4 of 5What an auditor asks for
Ask for
Records of security software updates: Request evidence of when the latest security software updates were applied across the organisation.
Look at
Update logs to confirm regular updates, particularly any focused on macro threat mitigation.
Good evidence
Is a log entry that shows updates are performed automatically and regularly.
- Check 5 of 5What an auditor asks for
Ask for
Response plan documentation: Request the document outlining the response steps for when a risky macro is detected.
Look at
Clear, easy-to-read instructions that describe actions employees should take.
Good evidence
Document will have steps listed and contacts for IT support.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML1.2, Block Microsoft Office macros from the internet, which asks for the same thing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RM-ML1.2.
E8-RM-ML1.2 requires Microsoft Office macros in files originating from the internet to be blocked to prevent internet-borne macro execution. ISM-1488 states the same requirement: blocking Microsoft Office macros in files originating from the internet. The scope and intent align closely, with both focused on the Mark-of-the-Web/internet-origin trust boundary for Office macro execution.
This control is broader than E8-RM-ML3.1.
ISM-1488 requires that Microsoft Office macros in files originating from the internet are blocked. E8-RM-ML3.1 is broader because it restricts macro execution to only trusted locations, sandboxed environments, or trusted digital signatures (regardless of origin), which would include blocking untrusted internet-sourced macros. ISM-1488 is one specific hardening condition within E8-RM-ML3.1's wider macro trust model.
This control depends on E8-RM-ML1.4.
ISM-1488 requires that Microsoft Office macros in files originating from the internet are blocked. E8-RM-ML1.4 supports this by preventing users from weakening or bypassing the macro blocking posture through changing macro security settings. ISM-1488 is about the security outcome (blocked internet macros), while E8-RM-ML1.4 is about assuring the setting remains enforced.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.