ISM-1672 policy ASD Information Security Manual (ISM)

Enable Antivirus Scanning for Office Macros

Ensure Microsoft Office is set to scan macros for viruses to protect against malware.

Preventative ML1 ML2 ML3 NC OS P ASD Information Security ManualGuidelines for system hardening malware configuration awareness training

record_voice_over

Plain language

Having Microsoft Office scan macros for viruses is crucial because macros can be used by hackers to sneak viruses into your computer. If this isn't done, these hidden viruses could steal important information or cause serious disruption to your business operations.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2021

Control Stack last updated

19 Mar 2026

E8 maturity levels

ML1, ML2, ML3

Guideline

Guidelines for system hardening

Section

User application hardening

Topic

Microsoft Office Macros

Official control statement

Microsoft Office macro antivirus scanning is enabled.

policy ASD Information Security Manual (ISM) ISM-1672

priority_high

Why it matters

If Office macros aren’t scanned for viruses, macro malware can execute, causing credential theft, data loss or disruption.

settings

Operational notes

Confirm Office macro antivirus scanning is enabled in AV/EDR policy; test with a macro sample and monitor detections.

02 - Implement

build

Implementation tips

IT team should check Office settings: Verify that Microsoft Office is configured to scan all macros. This can be done by going into the settings of each Office application, such as Word or Excel, and ensuring that macro security settings are set to the highest level.
Office manager to educate staff: Ensure that all staff members understand the risks of macros by conducting a brief training session. Explain how a macro can be a potential threat and show them where to find macro settings in Office applications so they can check these easily.
System owner to monitor configurations: Regularly review and maintain the settings to ensure they haven't reverted or been changed. This may involve scheduling checks every month or using monitoring tools to alert the IT team if settings are altered.
Procurement team to ensure software version: Confirm that all systems are running up-to-date versions of Microsoft Office that include the necessary security options to scan macros. This could involve maintaining a list of licences and checking vendor notifications for updates.
IT support to set group policies: Implement group policies that automatically enforce macro scanning settings across all Office applications. This ensures that even if someone tries to bypass the settings, the system will revert to secure defaults automatically.

03 - Audit

fact_check

Audit / evidence tips

AskConfiguration reports: Request reports or screenshots showing macro security settings from each Office application GoodA report with screenshots from all relevant applications showing correct configurations
AskTraining attendance records: Request records of employee training sessions on macros and their risks GoodA list of all staff members with completion dates and training materials attached
AskVersion logs: Request logs or documentation showing the versions of Microsoft Office in use across the organisation GoodA log showing all systems with the latest allowed versions listed
AskChange monitoring alerts: Request evidence of alerts or logs that show when configurations are changed GoodA log or alert history indicating no unauthorised changes
AskGroup policy configurations: Request details of group policies applied to manage macro settings GoodDocumentation showing the policy is active and enforceable

04 - Mappings

link

Cross-framework mappings

How ISM-1672 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layers Partially meets (1) expand_less
Annex A 8.7	ISM-1672 requires a specific malware protection configuration: enabling antivirus scanning for Microsoft Office macros

E8

Control	Notes	Details
sync_alt Partially overlaps (3) expand_less

E8-AH-ML2.3	ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro-enabled content

E8-RM-ML1.2	ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro content
E8-RM-ML3.1	ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to identify malicious macros at runtime or on access
handshake Supports (2) expand_less

E8-RM-ML1.4	ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled as a protective configuration
E8-RM-ML3.2	E8-RM-ML3.2 requires macros to be checked to ensure they are free of malicious code before being signed or trusted via Trusted Locations
link Related (1) expand_less

E8-RM-ML1.3	ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.