ASD ISM 1674 Ensuring secure execution of Microsoft Office macros
What it says
Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly safe Microsoft Office macros are allowed to run, using security measures like sandboxing or trusted signatures.
This control is about making sure that only safe macros-small programs you can run in Microsoft Office-are allowed to execute on your computer. Without this, you could accidentally run a harmful macro that steals information, corrupts files, or damages your system.
Free. Save your status, tasks and notes.
Why it matters
Unchecked Office macros can run malicious code, leading to compromise unless sandboxed, trusted or signed.
How to implement
Business owners should talk to their IT support team about setting up secure environments for running macros.
Encourage them to ensure that Microsoft Office macros are only executed in pre-approved locations, like a trusted folder on your network.
Office managers should work with the IT department to identify which macros are necessary for daily operations.
Make a list of all essential macros and ensure they are either from a trusted source or signed by a reputable publisher.
IT teams should configure the settings in Microsoft Office to only run macros from trusted locations.
This involves adjusting the trust settings within each Office application to restrict where macros can be executed.
Procurement teams should review software contracts to ensure they include the ability to digitally sign Microsoft Office macros.
This means ensuring that any software that generates or uses macros has the capability to attach a digital signature from a trusted publisher.
System administrators should regularly update and maintain the list of trusted publishers whose macros can run on the network.
This involves checking publisher credentials and verifying they remain trustworthy over time.
Keep it running
Allow macro execution only from Trusted Locations, a sandbox, or macros signed by trusted publishers; review regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security policy for running macros in Microsoft Office: Request the document that explains how macros are managed and what measures are in place.
Look at
Mentions of sandboxing, trusted locations, and digital signatures.
Good evidence
Is a clearly documented policy showing these controls are defined and enforced.
- Check 2 of 5What an auditor asks for
Ask for
The list of approved macros and their sources: Request an inventory of all macros currently used within the business.
Look at
The list to check for trusted publishers or signatures.
Good evidence
Would include macros listed with their source and a record of approval.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of Microsoft Office security settings: Request to see how macros are restricted within Office applications.
Look at
Settings for trusted locations and digital signature enforcement.
Good evidence
Demonstration shows macros set to run only from authorised locations.
- Check 4 of 5What an auditor asks for
Ask for
IT security logs related to macro security: Request logs documenting attempted macro executions and any blocked incidents.
Look at
These logs for entries that indicate the control is blocking unauthorised macros.
Good evidence
Includes recent logs with no successful unauthorised macro executions.
- Check 5 of 5What an auditor asks for
Ask for
The latest update report from the IT team about trusted publisher reviews: Request a document showing when and how trusted publishers were reviewed.
Look at
Details on which publishers are approved and the criteria for their approval.
Good evidence
Provides evidence of thorough and regular reviews.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.1, Restrict Microsoft Office macros to only trusted or sandboxed environments, which asks for the same thing.
ASD Essential Eight: 9 mappings
This control is equivalent to E8-RM-ML3.1.
ISM-1674 requires that only Microsoft Office macros running in a sandbox, from a Trusted Location, or digitally signed by a trusted publisher are allowed to execute. E8-RM-ML3.1 states the same execution gating conditions for macros (sandboxed, Trusted Location, or trusted digital signature). Both controls have effectively identical scope and intent around preventing unsafe macro execution.
- E8-RM-ML3.4Untrusted publisher macros cannot be enabled via Message Bar or Backstage ViewBroader than
This control is broader than E8-RM-ML3.4.
E8-RM-ML3.4 focuses on preventing users from enabling untrusted-publisher signed macros via the Message Bar or Backstage View. ISM-1674 is broader, requiring that only macros from a sandboxed environment, Trusted Location, or trusted publisher are allowed to execute (covering more execution paths than just UI enablement). E8-RM-ML3.4 is one specific enforcement aspect that contributes to meeting the broader execution-allowlist posture in ISM-1674.
This control partially overlaps E8-RM-ML1.1.
ISM-1674 requires that only macros from a sandboxed environment, Trusted Location, or trusted publisher signature are allowed to execute. E8-RM-ML1.1 overlaps by reducing macro execution exposure through disabling macros for users without a business need, which complements ISM-1674's conditional allow-listing. ISM-1674 focuses on where/how macros may run, while E8-RM-ML1.1 focuses on who should have macros enabled at all.
This control partially overlaps E8-RM-ML1.2.
E8-RM-ML1.2 requires blocking Microsoft Office macros specifically when the file originates from the internet. ISM-1674 supports this by defining the broader allowed-execution model (only sandboxed, Trusted Location, or trusted signed macros may run), which is a common way to enforce macro restrictions. ISM-1674 is not limited to internet-origin files, but implementing it typically results in blocking internet-origin macros unless they meet the trusted execution criteria.
This control supports E8-RM-ML3.5.
ISM-1674 requires that only macros that are sandboxed, from Trusted Locations, or signed by a trusted publisher are allowed to execute. E8-RM-ML3.5 supports this by restricting the ability to enable macros with non-V3 signatures via common Office enablement prompts, reducing acceptance of weaker or non-compliant signing. ISM-1674 focuses on the allowed execution conditions, whereas E8-RM-ML3.5 specifically constrains one enablement mechanism and signature type quality.
This control depends on E8-RM-ML1.4.
ISM-1674 requires enforcement of macro execution so that only sandboxed, Trusted Location, or trusted-signed macros can run. E8-RM-ML1.4 supports this by preventing users from changing Office macro security settings that could weaken or bypass the enforcement of ISM-1674. ISM-1674 defines the execution allow-list conditions, while E8-RM-ML1.4 is a configuration integrity control to keep those conditions intact.
This control depends on E8-RM-ML3.2.
ISM-1674 requires that only macros from sandboxed environments, Trusted Locations, or signed by a trusted publisher are allowed to execute. E8-RM-ML3.2 supports this by requiring macros be checked for malicious code before being signed or placed into Trusted Locations, reducing the risk that "allowed" macros are actually malicious. ISM-1674 is primarily an execution control, while E8-RM-ML3.2 is a pre-approval assurance activity for the same trust pathways.
This control depends on E8-RM-ML3.3.
ISM-1674 requires that only macros from a sandbox, Trusted Location, or trusted publisher signature can execute. E8-RM-ML3.3 supports this by restricting who can write or modify content in Trusted Locations, helping ensure the Trusted Location pathway in ISM-1674 cannot be abused by unprivileged users. ISM-1674 defines the permitted execution sources, while E8-RM-ML3.3 strengthens governance and integrity of one of those sources (Trusted Locations).
This control depends on E8-RM-ML3.6.
ISM-1674 requires that macro execution is limited to sandboxed macros, Trusted Locations, or those signed by a trusted publisher. E8-RM-ML3.6 supports this by ensuring the organisation's list of trusted publishers remains accurate and current through regular validation, which directly affects what is considered "trusted" under ISM-1674. ISM-1674 sets the rule for execution; E8-RM-ML3.6 governs ongoing maintenance of trust decisions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.