ASD ISM 1668 Prevent Microsoft Office from creating executable files
What it says
Microsoft Office is blocked from creating executable content.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMicrosoft Office is set to not produce executable files to enhance security.
Microsoft Office should not create executable files because these files can contain harmful software that may harm your computer or network. By preventing Office from creating such files, you reduce the risk of malicious software spreading and protect your organisation's data and finances.
Free. Save your status, tasks and notes.
Why it matters
Allowing Office to create executable files can enable malware dropper behaviour, leading to compromise, data exfiltration and financial loss.
How to implement
IT team should configure group policies: Set policies in your organisation's IT system to block Microsoft Office applications from saving or creating executable files.
This can typically be done using Group Policy Management tools available in your IT infrastructure.
System administrator should update security settings: Regularly review Microsoft Office security settings to ensure the feature preventing executable file creation is active.
This involves checking configuration settings and comparing them against best practice guidelines to keep your systems safe.
Office manager needs to educate staff: Run a quick training session with staff to explain why they shouldn't download executable files from email attachments or external sources.
Use real-world examples of past incidents to underline the risks involved.
Procurement team to check software compatibility: Before buying new software, ensure it can operate without needing Microsoft Office to create executable files.
Request vendor documentation or test the software on a safe network to confirm it functions as needed without risks.
Security officer should monitor for compliance: Use system tools to track and generate reports on attempts to create executable files through Office.
Address any issues by investigating who attempted to create the file and why, and offer training if needed.
Keep it running
Enforce Office policies that block executable creation; regularly verify settings via GPO/Intune and alert on changes to reduce malware dropped from Office.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The Group Policy configuration: Request documentation of the IT settings that enforce the non-creation of executable files by Microsoft Office programs.
Look at
The specific policy rules and restrictions in place that block executable file creation.
Good evidence
Includes dated documentation showing the policy is correctly configured and regularly reviewed.
- Check 2 of 5What an auditor asks for
Look at
Attendance sheets or records of e-learning completions that cover not creating executable files.
Good evidence
Shows majority staff participation and recent training completion within the last year.
- Check 3 of 5What an auditor asks for
Ask for
Security tool reports: Request a report from any security monitoring tools in use that track executable file creation attempts.
Look at
How many incidents have been detected and actions taken afterwards.
Good evidence
Consists of no recent incidents or documented follow-up actions on previous detections.
- Check 4 of 5What an auditor asks for
Look at
Vendor confirmations or test results that prove software functions without Office-created executables.
Good evidence
Includes documented checks for all new software acquired in the last year.
- Check 5 of 5What an auditor asks for
Ask for
Incident response records: Request any security incident reports where Office-created executable files were involved.
Look at
Detailed responses outlining how issues were resolved and preventive measures adopted.
Good evidence
Will include a thorough follow-up plan showing the incident was promptly handled.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.3, Block Microsoft Office from creating executable content, which asks for the same thing.
ASD Essential Eight: 6 mappings
This control is equivalent to E8-AH-ML2.3.
ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AH-ML2.3 specifies the same hardening outcome for Microsoft Office, namely preventing it from creating executable content. Both controls have the same technical intent and effect, with no material scope difference apparent from the statements.
This control partially meets E8-AH-ML2.6.
E8-AH-ML2.6 requires organisations to harden office productivity suites using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. ISM-1668 is a specific hardening setting for Microsoft Office (blocking it from creating executable content) that would typically be included within an office suite hardening baseline. E8-AH-ML2.6 therefore encompasses ISM-1668 as one concrete configuration measure within the broader office suite hardening requirement.
This control partially overlaps E8-AC-ML1.3.
ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AC-ML1.3 is a broader application control that restricts execution of executables and scripts to an organisation-approved set across the environment, which can contain the impact even if malicious executables are created. ISM-1668 focuses on a specific Office hardening measure, while E8-AC-ML1.3 covers multiple applications and execution locations beyond Microsoft Office.
This control partially overlaps E8-AH-ML2.2.
ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AH-ML2.2 relates by reducing Office's ability to spawn execution pathways, but it focuses on blocking child process creation rather than blocking creation of executable files. ISM-1668 can still allow child processes in some configurations, while E8-AH-ML2.2 can be met even if Office can write executable content to disk.
This control partially overlaps E8-AH-ML2.4.
E8-AH-ML2.4 requires blocking Microsoft Office from injecting code into other processes to prevent in-memory execution and tampering. ISM-1668 requires blocking Microsoft Office from creating executable content, addressing a different persistence/execution pathway (dropping or generating executables) rather than injection. They commonly co-exist as Office hardening measures, but each control targets a distinct attacker technique.
This control partially overlaps E8-AH-ML2.5.
E8-AH-ML2.5 requires Microsoft Office to prevent activation of OLE packages to limit execution of embedded content. ISM-1668 blocks Microsoft Office from creating executable content, addressing a broader set of Office behaviours used to drop malware (including but not limited to OLE-delivered payloads). The controls intersect around preventing Office from being used as an initial infection vector, but each targets a different mechanism (OLE activation vs file creation).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.