ASD ISM 1542 Disable OLE in Microsoft Office for security
What it says
Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMicrosoft Office is set to block OLE, a feature that could pose security risks.
This control requires Microsoft Office to disable a feature called Object Linking and Embedding (OLE). OLE can create opportunities for cyber attackers to sneak harmful software into your system through supposedly legitimate files. By turning off OLE, you reduce the risk of opening your business up to data breaches or malware infections, which could cost you time, money, and trust.
Free. Save your status, tasks and notes.
Why it matters
If OLE is not disabled, embedded OLE packages in Office files may execute, enabling malware infection, data theft, or host compromise.
How to implement
IT staff should configure Microsoft Office settings to disable OLE.
This involves accessing the Office application options and specifically turning off any OLE functionalities through policy settings. This can be done using group policies if you manage multiple computers within the organisation.
The IT security manager should communicate the change in OLE functionality to all staff.
This could involve a short email explaining what OLE is, why it has been disabled, and how this affects their daily tasks to ensure everyone is informed and prepared.
System administrators should test document functionalities after disabling OLE.
They can do this by trying to open, edit, and save different types of Office documents to ensure that disabling OLE doesn't disrupt everyday work processes and that no critical features are affected.
Office managers or team leaders should gather feedback from staff about any disruptions caused by disabling OLE.
This step includes organising a brief meeting or survey to identify any issues employees might face, enabling the IT team to adjust settings or provide alternative solutions.
IT teams should create a backup of current Office settings before disabling OLE.
This involves documenting the existing configuration and exporting current settings to a secure location in case they need to revert to the previous setup.
Keep it running
Regularly verify Office GPO/registry settings keep OLE activation disabled and test with sample files after updates to ensure it cannot be re-enabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A record of the Office settings changes: Request documentation that details the adjustments made to disable OLE across your organisation's Office suite.
Look at
The specific setting name and value that indicates OLE is turned off.
Good evidence
Is a document or screenshot showing the policy applied and active status.
- Check 2 of 5What an auditor asks for
Ask for
A testing log: Request records showing the tests carried out to ensure Office functionality is not impaired after disabling OLE.
Look at
Entries that describe tests performed, dates, and outcomes.
Good evidence
Includes a spreadsheet or database with successful test results and sign-offs from IT.
- Check 3 of 5What an auditor asks for
Ask for
Communication records to staff: Request to see the email or memo sent to staff regarding the OLE changes.
Look at
The date sent, content explaining the changes, and recipients list.
Good evidence
Is an email or document from a date close to the implementation, ensuring all staff were informed.
- Check 4 of 5What an auditor asks for
Ask for
Feedback collection method: Request how feedback from staff was gathered and documented post-implementation.
Look at
A formal survey, meeting notes, or email responses that capture employee concerns or acknowledgments.
Good evidence
Is a summary report with key observations and actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Backup procedure documentation: Request evidence that backs up settings were created before implementing OLE changes.
Look at
Descriptions or files of pre-change configuration stored securely.
Good evidence
Is a procedure document or verification that backups were made and stored correctly.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.5, Configure Microsoft Office to prevent activation of OLE packages, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AH-ML2.5.
E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of Object Linking and Embedding (OLE) packages. ISM-1542 states the same requirement for disabling or preventing OLE activation in Microsoft Office. Both controls are aligned in scope (Office configuration) and intent (reduce OLE-based attack paths), so implementing one would largely satisfy the other.
This control depends on E8-AH-ML2.7.
E8-AH-ML2.7 requires that office productivity suite security settings cannot be changed by users. ISM-1542 mandates configuring Microsoft Office to prevent activation of OLE packages, which is one concrete Office security hardening setting that should be enforced centrally. While ISM-1542 does not itself require immutability of settings, making Office settings immutable (E8-AH-ML2.7) helps ensure the OLE restriction in ISM-1542 remains enforced and cannot be user-disabled.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.