ASD ISM 1675 Prevent enabling untrusted Microsoft Office macros
What it says
Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMacros from untrusted sources in Microsoft Office can't be enabled through standard interfaces.
This control is about stopping Microsoft Office from running suspicious little programs called macros that originate from sources we don't trust. It's important because if harmful macros get in, they can mess with your files or steal information, like leaving your front door open for thieves.
Free. Save your status, tasks and notes.
Why it matters
If untrusted Office macros run, they can automate data theft or malware spread, critically compromising business operations and security.
How to implement
IT team should configure Microsoft Office group policies: They need to set up rules that automatically block macros from any untrusted source.
This involves using the Group Policy Editor to navigate to the Microsoft Office settings and enabling the 'Disable all macros without notification' option.
Managers should educate staff about macro security: Organise a short training session to explain the dangers of enabling macros from unknown sources.
Use real-world examples (like email scams) to illustrate how bad macros can sneak in and cause damage.
IT support should regularly update Microsoft Office: Ensure all Office applications are kept up-to-date with the latest security patches.
Use automatic updating settings in the Office suite to make this process seamless and less prone to human error.
System administrators should set up security alerts: They need to configure the network to send alerts if there's any attempt to enable macros from untrusted sources.
Use existing monitoring systems to watch out for this activity without overwhelming employees with notifications.
Procurement should ensure compliance with security policies: When buying or renewing software licences, check that all software supports disabling untrusted macros.
Include specific requirements for macro management in software procurement contracts.
Keep it running
Regularly verify that macro settings are enforced to block unsigned macros and educate users to avoid altering these via Message Bar or Backstage View.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A report on Group Policy settings for Office: Request documentation showing the current Office group policy settings regarding macros.
Look at
The settings to ensure they match the policy of disabling all untrusted macros.
Good evidence
Shows that macros are blocked unless they're from a trusted source.
- Check 2 of 5What an auditor asks for
Ask for
A list of any exceptions made to this policy: Request any documentation of exceptions where macros from untrusted sources might have been enabled. Check for appropriate authorisation and risk assessment in these cases.
Good evidence
Includes detailed reasoning and approvals for any exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Records of staff training sessions on macro security: Request minutes or records of any conducted staff training sessions regarding Office macro security.
Look at
Evidence that the sessions were attended and covered relevant topics.
Good evidence
Has dated session records and participant lists.
- Check 4 of 5What an auditor asks for
Ask for
To see update logs for Office applications: Request logs or reports showing recent updates to Office applications.
Look at
The dates and the type of updates applied to ensure that security patches are regularly installed.
Good evidence
Shows consistent and recent updates aligned with vendor release notes.
- Check 5 of 5What an auditor asks for
Ask for
Alerts and responses to potential macro threats: Request examples of alerts generated and the subsequent responses in handling them.
Look at
The detail and timeliness of responses to determine efficacy.
Good evidence
Includes prompt detection and written response procedures.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.4, Untrusted publisher macros cannot be enabled via Message Bar or Backstage View, which asks for the same thing.
ASD Essential Eight: 7 mappings
This control is equivalent to E8-RM-ML3.4.
E8-RM-ML3.4 requires that Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. ISM-1675 states the same end-state control behaviour in the same Microsoft Office user interface paths. Both are effectively the same requirement and implementing one would largely satisfy the other.
This control partially overlaps E8-RM-ML1.1.
ISM-1675 requires that macros signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. E8-RM-ML1.1 reduces macro risk by disabling macros entirely for users without a business need, which in practice also prevents enabling untrusted macros for those users. They overlap in limiting macro execution, but ISM-1675 is a conditional block based on publisher trust while E8-RM-ML1.1 is a user-scope reduction control.
This control partially overlaps E8-RM-ML1.2.
E8-RM-ML1.2 requires blocking macros in Microsoft Office files originating from the internet. ISM-1675 supports this by preventing users from enabling macros signed by an untrusted publisher via the Message Bar or Backstage View, reducing the chance that an internet-delivered macro can be run through user override. ISM-1675 focuses on publisher trust and user enablement pathways, not the internet-origin attribute itself.
- E8-RM-ML3.5Block enabling of non-V3 signed Microsoft Office macros via Message BarPartially overlaps
This control partially overlaps E8-RM-ML3.5.
E8-RM-ML3.5 blocks users from enabling macros via Office UI when the macro is not signed with a V3 signature. ISM-1675 blocks users from enabling macros via the same UI when the publisher is untrusted, regardless of signature version. They intersect on preventing user enablement of risky macros via Message Bar/Backstage View, but each uses a different trust criterion (V3 signature format vs trusted publisher status).
This control supports E8-RM-ML1.4.
ISM-1675 requires a specific macro-enablement restriction (untrusted publisher macros cannot be enabled via Message Bar or Backstage View). E8-RM-ML1.4 supports this by preventing users from changing macro security settings that could otherwise weaken or bypass the intended restriction. The primary is the required technical behaviour in Office, whereas E8-RM-ML1.4 is a hardening control to preserve that behaviour.
This control depends on E8-RM-ML3.1.
E8-RM-ML3.1 permits only trusted/sandboxed/signed Office macros to execute. ISM-1675 supports E8-RM-ML3.1 by preventing users from enabling macros signed by untrusted publishers through Office prompts, reducing the risk of bypassing macro trust decisions. E8-RM-ML3.1 establishes the allow rule, while ISM-1675 strengthens user interaction paths to prevent rule circumvention.
This control depends on E8-RM-ML3.6.
E8-RM-ML3.6 requires organisations to annually validate the Microsoft Office trusted publishers list so trust decisions about macro signers remain current. ISM-1675 prevents users from enabling macros signed by an untrusted publisher via Office UI pathways, which relies on the trusted/untrusted publisher boundary being accurate. Validating the trusted publishers list (E8-RM-ML3.6) strengthens ISM-1675 by reducing the chance a malicious or obsolete publisher remains incorrectly trusted.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.