ASD ISM 1672 Enable antivirus scanning for Office macros
What it says
Microsoft Office macro antivirus scanning is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Microsoft Office is set to scan macros for viruses to protect against malware.
Having Microsoft Office scan macros for viruses is crucial because macros can be used by hackers to sneak viruses into your computer. If this isn't done, these hidden viruses could steal important information or cause serious disruption to your business operations.
Free. Save your status, tasks and notes.
Why it matters
If Office macros aren't scanned for viruses, macro malware can execute, causing credential theft, data loss or disruption.
How to implement
IT team should check Office settings: Verify that Microsoft Office is configured to scan all macros.
This can be done by going into the settings of each Office application, such as Word or Excel, and ensuring that macro security settings are set to the highest level.
Office manager to educate staff: Ensure that all staff members understand the risks of macros by conducting a brief training session.
Explain how a macro can be a potential threat and show them where to find macro settings in Office applications so they can check these easily.
System owner to monitor configurations: Regularly review and maintain the settings to ensure they haven't reverted or been changed.
This may involve scheduling checks every month or using monitoring tools to alert the IT team if settings are altered.
Procurement team to ensure software version: Confirm that all systems are running up-to-date versions of Microsoft Office that include the necessary security options to scan macros.
This could involve maintaining a list of licences and checking vendor notifications for updates.
IT support to set group policies: Implement group policies that automatically enforce macro scanning settings across all Office applications.
This ensures that even if someone tries to bypass the settings, the system will revert to secure defaults automatically.
Keep it running
Confirm Office macro antivirus scanning is enabled in AV/EDR policy; test with a macro sample and monitor detections.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Configuration reports: Request reports or screenshots showing macro security settings from each Office application.
Look at
Whether settings are consistent across all office applications and set to the highest security level.
Good evidence
A report with screenshots from all relevant applications showing correct configurations.
- Check 2 of 5What an auditor asks for
Ask for
Training attendance records: Request records of employee training sessions on macros and their risks.
Look at
The names of attendees and the content of the training.
Good evidence
A list of all staff members with completion dates and training materials attached.
- Check 3 of 5What an auditor asks for
Ask for
Version logs: Request logs or documentation showing the versions of Microsoft Office in use across the organisation.
Look at
Whether all versions are up-to-date and have security features enabled.
Good evidence
A log showing all systems with the latest allowed versions listed.
- Check 4 of 5What an auditor asks for
Ask for
Change monitoring alerts: Request evidence of alerts or logs that show when configurations are changed.
Look at
Whether there are alerts for macro setting changes.
Good evidence
A log or alert history indicating no unauthorised changes.
- Check 5 of 5What an auditor asks for
Ask for
Group policy configurations: Request details of group policies applied to manage macro settings.
Look at
Whether these policies enforce secure macro settings across all Office applications.
Good evidence
Documentation showing the policy is active and enforceable.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML1.3, Enable antivirus scanning for Microsoft Office macros, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1672 requires a specific malware protection configuration: enabling antivirus scanning for Microsoft Office macros. Annex A 8.7 requires organisations to implement protection against malware more generally, supported by appropriate user awareness. ISM-1672 is a concrete technical subset of the broader malware protection expectations in Annex A 8.7.
ASD Essential Eight: 6 mappings
This control is equivalent to E8-RM-ML1.3.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled. E8-RM-ML1.3 specifies the same configuration outcome-enabling antivirus scanning for Microsoft Office macros. Both controls are aligned in scope and intent, and implementing either would largely satisfy the other.
This control partially overlaps E8-AH-ML2.3.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro-enabled content. E8-AH-ML2.3 reduces macro-borne risk by blocking Microsoft Office from creating executable content, which targets a common malware delivery chain that macro malware may use after execution. The controls intersect in mitigating macro-enabled malware, but one is detection-oriented (scanning) and the other is prevention-oriented (blocking executable creation).
This control partially overlaps E8-RM-ML1.2.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro content. E8-RM-ML1.2 blocks macros in files originating from the internet, reducing exposure to common phishing and drive-by macro payloads that scanning would otherwise need to detect. The overlap is macro malware mitigation, but E8-RM-ML1.2 is a source-based execution block whereas ISM-1672 is a scanning/detection setting that can apply more broadly.
- E8-RM-ML3.1Restrict Microsoft Office macros to only trusted or sandboxed environmentsPartially overlaps
This control partially overlaps E8-RM-ML3.1.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to identify malicious macros at runtime or on access. E8-RM-ML3.1 restricts macro execution to sandboxed environments, Trusted Locations, or digitally signed macros from trusted publishers, thereby controlling where and when macros can run. Both reduce macro malware risk, but E8-RM-ML3.1 focuses on execution trust boundaries while ISM-1672 focuses on malware detection via scanning.
This control depends on E8-RM-ML1.4.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled as a protective configuration. E8-RM-ML1.4 ensures users cannot change Microsoft Office macro security settings, which helps preserve the enabled scanning state and prevents user-driven weakening of macro protections. E8-RM-ML1.4 is about configuration enforcement, while ISM-1672 is the specific setting to be enforced.
This control depends on E8-RM-ML3.2.
E8-RM-ML3.2 requires macros to be checked to ensure they are free of malicious code before being signed or trusted via Trusted Locations. ISM-1672 supports this by enabling antivirus scanning for Office macros, which is a key technical mechanism that can be used during the checking step. ISM-1672 is about configuring a detection capability, while E8-RM-ML3.2 is about the governance/assurance decision to only sign or trust macros after verification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.