ASD ISM 1601 Implement Microsoft Attack Surface Reduction rules
What it says
Microsoft's attack surface reduction rules are implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply Microsoft's rules to reduce potential weaknesses in user applications.
This control is about applying Microsoft's security rules to make your computer systems safer. These rules help by closing off paths that hackers could use to attack your applications. If these paths aren't reduced, it makes it easier for hackers to break into your systems, steal information, or cause disruptions to your business.
Free. Save your status, tasks and notes.
Why it matters
Without Microsoft Attack Surface Reduction (ASR) rules, Windows endpoints are more exposed to commodity malware and ransomware via Office/macros and scripting.
How to implement
The IT team should review Microsoft's recommended attack surface reduction rules.
They do this by consulting Microsoft's online documentation or their internal IT policy resources. This helps ensure they are aware of the rules that could be applied to their systems.
System owners should configure these rules on all applicable systems.
They can do this by accessing system settings through Microsoft's security management tools and applying each rule as guided. This process should be scheduled during a low-traffic time to avoid disrupting users.
Managers should ensure staff are aware of these security changes.
They should communicate to their teams the purpose and benefits of the new rules via email or a short team meeting. This helps in gaining voluntary compliance and cooperation.
The security team should regularly monitor the effectiveness of these rules.
They should use available reporting tools to analyse any issue logs that indicate violations or blocks by the rules, adapting settings as needed to minimise unnecessary disruption.
Procurement staff need to prioritise acquiring or renewing Microsoft licences that support these reduction rules.
They should work with budgets to ensure all systems have the requisite licences by liaising with providers well in advance of deadlines.
Keep it running
Manage ASR rules via Intune/GPO; review audit/block events in Defender, tune exclusions, and retest after Office or app updates.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The list of currently implemented Microsoft attack surface reduction rules.
Look at
The list to see if it aligns with the latest guidance issued by Microsoft.
Good evidence
Is a comprehensive list showing dates of implementation and coverage across all known applications.
- Check 2 of 4What an auditor asks for
Ask for
Change management records relating to the implementation of these rules.
Look at
The dates and descriptions of changes implemented.
Good evidence
Is records that show timely updates and justification for each configuration change.
- Check 3 of 4What an auditor asks for
Look at
Emails or meeting notes that detail what was communicated and when.
Good evidence
Is evidence of system-wide communication that outlines both the changes and their expected impact.
- Check 4 of 4What an auditor asks for
Ask for
The incident logs filtered to show activity related to these rules.
Look at
Trends that might suggest wrongly configured or overly restrictive settings.
Good evidence
Is logs indicating the rules are effectively blocking known threats rather than causing legitimate access issues.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.2, Block Microsoft Office from creating child processes, which asks for the same thing.
ASD Essential Eight: 6 mappings
This control is equivalent to E8-AH-ML2.2.
ISM-1601 requires organisations to implement Microsoft Attack Surface Reduction rules. E8-AH-ML2.2 maps directly because an ASR rule exists to block Office applications from creating child processes, matching the candidate's stated control outcome. Implementing that ASR rule under ISM-1601 would largely satisfy E8-AH-ML2.2 for this specific behaviour.
This control is equivalent to E8-AH-ML2.4.
ISM-1601 requires organisations to implement Microsoft Attack Surface Reduction rules. E8-AH-ML2.4 maps directly because one of Microsoft's ASR rules is to block Office applications from injecting code into other processes, which is exactly the behaviour described. Implementing the relevant ASR rule to satisfy ISM-1601 would largely satisfy E8-AH-ML2.4 for that requirement.
This control partially overlaps E8-AC-ML2.3.
ISM-1601 requires implementation of Microsoft ASR rules to reduce the attack surface on endpoints. E8-AC-ML2.3 relates because Microsoft's recommended application blocklists (e.g. Defender blocklists) and ASR both prevent execution of known-bad or risky behaviours. However, blocklists focus on restricting specific applications/artifacts, while ISM-1601 focuses on ASR behavioural rules (e.g. process creation, script abuse) that are not limited to a named app list.
This control partially overlaps E8-RM-ML1.4.
ISM-1601 requires organisations to implement Microsoft Attack Surface Reduction (ASR) rules to reduce exploitable behaviours in user applications. E8-RM-ML1.4 relates because several ASR rules (or complementary Defender/Microsoft 365 policy controls) can be used to enforce macro hardening outcomes, including preventing users from weakening macro security. However, E8-RM-ML1.4 is specifically about locking down Office macro security settings, whereas ISM-1601 is broader across multiple ASR rules beyond macros.
This control partially overlaps E8-RM-ML2.1.
ISM-1601 requires implementation of Microsoft ASR rules to reduce common exploit behaviours across user applications. E8-RM-ML2.1 relates directly because blocking Office macros from making Win32 API calls is an Office/macro attack surface reduction outcome that aligns with Microsoft's preventative controls and can be enforced via Microsoft security policy. However, E8-RM-ML2.1 is narrowly scoped to a specific macro capability restriction, while ISM-1601 covers implementing ASR rules more broadly across multiple attack techniques.
This control supports E8-AH-ML2.5.
E8-AH-ML2.5 requires Microsoft Office to be configured to prevent activation of OLE packages. ISM-1601 requires implementation of Microsoft Attack Surface Reduction (ASR) rules, which commonly includes Office-hardening rules that reduce abuse of embedded content and related behaviours. ASR strengthens and can help enforce the intent of E8-AH-ML2.5, but it is broader and not limited to OLE package activation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.