ISM-1674 policy ASD Information Security Manual (ISM)

Ensuring Secure Execution of Microsoft Office Macros

Only safe Microsoft Office macros are allowed to run, using security measures like sandboxing or trusted signatures.

Preventative ML3 NC OS P ASD Information Security ManualGuidelines for system hardening application security

record_voice_over

Plain language

This control is about making sure that only safe macros-small programs you can run in Microsoft Office-are allowed to execute on your computer. Without this, you could accidentally run a harmful macro that steals information, corrupts files, or damages your system.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2021

Control Stack last updated

19 May 2026

E8 maturity levels

ML3

Guideline

Guidelines for system hardening

Section

User application hardening

Topic

Microsoft Office Macros

Official control statement

Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.

policy ASD Information Security Manual (ISM) ISM-1674

priority_high

Why it matters

Unchecked Office macros can run malicious code, leading to compromise unless sandboxed, trusted or signed.

settings

Operational notes

Allow macro execution only from Trusted Locations, a sandbox, or macros signed by trusted publishers; review regularly.

02 - Implement

build

Implementation tips

Business owners should talk to their IT support team about setting up secure environments for running macros. Encourage them to ensure that Microsoft Office macros are only executed in pre-approved locations, like a trusted folder on your network.
Office managers should work with the IT department to identify which macros are necessary for daily operations. Make a list of all essential macros and ensure they are either from a trusted source or signed by a reputable publisher.
IT teams should configure the settings in Microsoft Office to only run macros from trusted locations. This involves adjusting the trust settings within each Office application to restrict where macros can be executed.
Procurement teams should review software contracts to ensure they include the ability to digitally sign Microsoft Office macros. This means ensuring that any software that generates or uses macros has the capability to attach a digital signature from a trusted publisher.
System administrators should regularly update and maintain the list of trusted publishers whose macros can run on the network. This involves checking publisher credentials and verifying they remain trustworthy over time.

03 - Audit

fact_check

Audit / evidence tips

AskThe security policy for running macros in Microsoft Office: Request the document that explains how macros are managed and what measures are in place GoodIs a clearly documented policy showing these controls are defined and enforced
AskThe list of approved macros and their sources: Request an inventory of all macros currently used within the business GoodWould include macros listed with their source and a record of approval
AskA demonstration of Microsoft Office security settings: Request to see how macros are restricted within Office applications GoodDemonstration shows macros set to run only from authorised locations
AskIT security logs related to macro security: Request logs documenting attempted macro executions and any blocked incidents GoodIncludes recent logs with no successful unauthorised macro executions
AskThe latest update report from the IT team about trusted publisher reviews: Request a document showing when and how trusted publishers were reviewed GoodProvides evidence of thorough and regular reviews

04 - Mappings

link

Cross-framework mappings

How ISM-1674 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

E8

Control	Notes	Details
layers Partially meets (1) expand_less

E8-RM-ML3.4	E8-RM-ML3.4 focuses on preventing users from enabling untrusted-publisher signed macros via the Message Bar or Backstage View
sync_alt Partially overlaps (1) expand_less

E8-RM-ML1.1	ISM-1674 requires that only macros from a sandboxed environment, Trusted Location, or trusted publisher signature are allowed to execute
handshake Supports (6) expand_less

E8-RM-ML1.2	E8-RM-ML1.2 requires blocking Microsoft Office macros specifically when the file originates from the internet
E8-RM-ML1.4	ISM-1674 requires enforcement of macro execution so that only sandboxed, Trusted Location, or trusted-signed macros can run
E8-RM-ML3.2	ISM-1674 requires that only macros from sandboxed environments, Trusted Locations, or signed by a trusted publisher are allowed to execute
E8-RM-ML3.3	ISM-1674 requires that only macros from a sandbox, Trusted Location, or trusted publisher signature can execute
E8-RM-ML3.5	ISM-1674 requires that only macros that are sandboxed, from Trusted Locations, or signed by a trusted publisher are allowed to execute
E8-RM-ML3.6	ISM-1674 requires that macro execution is limited to sandboxed macros, Trusted Locations, or those signed by a trusted publisher
link Related (1) expand_less

E8-RM-ML3.1	ISM-1674 requires that only Microsoft Office macros running in a sandbox, from a Trusted Location, or digitally signed by a trusted publi...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.