ASD ISM 1676 Validate Microsoft Office trusted publishers list at least annually
What it says
Microsoft Office's list of trusted publishers is validated at least annually.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck the list of trusted publishers in Microsoft Office at least once a year so only approved software signers can run code automatically.
Microsoft Office keeps a list of "trusted publishers": software companies or developers whose signed add-ins and macros (small programs inside Office files) are allowed to run automatically without warning the user. This control says you must review that list at least once every year to make sure every entry is still meant to be there. If an outdated, unknown or malicious publisher stays on the list, harmful code could run silently on staff computers, so checking it annually keeps the list trustworthy.
Free. Save your status, tasks and notes.
Why it matters
If the trusted publishers list is never reviewed, an unknown or malicious signer could remain trusted and run harmful macros or add-ins on staff computers without any warning.
How to implement
The IT administrator should locate where the trusted publishers list lives in Microsoft Office (the Trust Centre settings on each computer, or the central Group Policy or Microsoft Intune configuration if the list is managed organisation-wide) so they know exactly what they are reviewing.
The IT administrator should schedule a recurring annual reminder (for example a calendar entry or ticket in the IT system) so the trusted publishers review happens on time every year and is not forgotten.
During each review, the IT administrator should compare every publisher on the list against an approved baseline and remove any entry that is unknown, no longer used, expired or was added without authorisation.
Where possible, the IT manager should lock down the list centrally using Group Policy or Microsoft Intune so individual staff cannot quietly add their own trusted publishers between annual reviews.
After each review, the person who performed it should record the date, who did it, what was found and any entries removed, then have a manager sign off so there is proof the validation actually took place.
Keep it running
Run this validation at least once a year, and also re-check the list after major Microsoft Office upgrades or changes to which add-ins your organisation uses.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the IT administrator to show the current list of trusted publishers configured in Microsoft Office (on a sample of computers or in the central management console).
Good evidence
is a short, clearly justified list where every publisher is recognised and approved.
- Check 2 of 5What an auditor asks for
Ask for
records of the most recent annual validation, including the date it was performed.
Good evidence
shows the last review happened within the past 12 months, not longer ago.
- Check 3 of 5What an auditor asks for
Ask for
who is responsible for performing the review and how it is scheduled.
Good evidence
names a specific role and points to a recurring reminder or calendar entry that triggers the check each year.
- Check 4 of 5What an auditor asks for
Ask for
what happens when an unrecognised or unwanted publisher is found during the review.
Good evidence
describes a clear process to remove it and document the change.
- Check 5 of 5What an auditor asks for
Ask for
how the list is prevented from being changed by ordinary staff between reviews.
Good evidence
shows the list is enforced centrally through Group Policy or Microsoft Intune rather than left editable on each individual computer.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.6, Validate list of trusted publishers in Microsoft Office annually, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RM-ML3.6.
ISM-1676 requires Microsoft Office's list of trusted publishers to be validated at least annually. E8-RM-ML3.6 states the same requirement with the same frequency and the same Microsoft Office trusted publisher list focus. Implementing either control would largely satisfy the other as they are aligned in scope and intent.
This control partially overlaps E8-AC-ML2.4.
E8-AC-ML2.4 requires organisations to validate their application control rulesets annually or more frequently. ISM-1676 similarly requires annual validation, but it is specific to Microsoft Office trusted publishers (a particular trust/allow mechanism) rather than the whole application control ruleset. The overlap is the periodic validation of allow-listing decisions, while ISM-1676 is narrower in technology and focus than E8-AC-ML2.4.
This control supports E8-RM-ML3.1.
ISM-1676 requires organisations to periodically validate which publishers are trusted in Microsoft Office. E8-RM-ML3.1 relies on the correctness of that trust decision because it allows macro execution when macros are signed by a trusted publisher (or are in a Trusted Location/sandbox). ISM-1676 strengthens E8-RM-ML3.1 by reducing the risk that an inappropriate or outdated publisher remains trusted and therefore permitted to run macros.
This control supports E8-RM-ML3.4.
E8-RM-ML3.4 requires that macros signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. ISM-1676 supports this by requiring validation of the trusted publishers list, which underpins what Office treats as 'trusted' versus 'untrusted' when enforcing E8-RM-ML3. ISM-1676 is governance/maintenance of trust anchors, while E8-RM-ML3.4 is the runtime enforcement outcome in the Office UI.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.