ASD ISM 1890 Ensure macros are free of malicious code
What it says
Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVerify that Microsoft Office macros are safe before signing or storing them in trusted locations.
This control ensures that any macros used in Microsoft Office documents are safe and free from malicious code before they're trusted or shared. If we don't check these macros, we risk hackers using them to access our systems and steal sensitive information or cause other damage.
Free. Save your status, tasks and notes.
Why it matters
Unchecked Microsoft Office macros can run malicious code, enabling unauthorised access, ransomware, or data theft via trusted documents.
How to implement
The IT team should regularly review and update the list of trusted sources for macros.
They can do this by setting policies within Microsoft Office to only allow macros from verified publishers, ensuring these settings are applied across all company devices.
Managers should educate staff about the dangers of enabling unknown macros.
They can arrange training sessions explaining how to identify trustworthy macros and encourage staff to report suspicious activity.
The IT team should use antivirus software to automatically scan macros for malicious code.
This involves setting up the software to regularly check all Office documents before they're saved or opened.
System owners must create a policy that requires all new macros to be reviewed and approved before use.
They should document this process clearly and ensure it includes steps for checking both the source and content of the macros.
Office managers should store all approved macros in a centralised location on their secure network.
This involves setting up a shared folder with restricted access, where only authorised personnel can add or modify macros.
Keep it running
Before signing or adding to Trusted Locations, review and test Office macros; use static analysis and malware scanning, then store approved versions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of trusted macro sources used by the organisation.
Look at
The criteria for a source to be added and when it was last reviewed.
Good evidence
Would show recent reviews and clear reasoning for each trusted source.
- Check 2 of 5What an auditor asks for
Good evidence
Includes a recent session with a list of attendees and detailed training materials.
- Check 3 of 5What an auditor asks for
Ask for
To see the antivirus configuration report for macro scanning.
Look at
Evidence that all Office documents are scanned consistently.
Good evidence
Will have a recent report showing that scans are up-to-date and cover all devices.
- Check 4 of 5What an auditor asks for
Look at
How it describes the review process and who is responsible.
Good evidence
Includes specific roles assigned and a recent date of policy update.
- Check 5 of 5What an auditor asks for
Ask for
Access to the secure folder containing approved macros. Check the permissions and last modification dates.
Good evidence
Shows restricted access to select personnel and recent activity logs.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.2, Check Microsoft Office macros for malicious code before signing or trusting, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.7.
Annex A 8.7 requires malware protection measures and user awareness to prevent and detect malicious code. ISM-1890 requires checking Microsoft Office macros for malicious code before signing or placing them in Trusted Locations, directly mitigating macro-based malware. ISM-1890 is a specific control for macro hygiene, whereas Annex A 8.7 is broader and includes other malware protections and awareness beyond macro governance.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RM-ML3.2.
E8-RM-ML3.2 requires Microsoft Office macros to be checked to ensure they are free of malicious code before they are digitally signed or placed within Trusted Locations. ISM-1890 states the same requirement with the same trigger points (signing or Trusted Locations) and the same security intent (prevent trusting malicious macros). Implementing either control would largely satisfy the other because their scope and depth are effectively identical.
This control partially overlaps E8-RM-ML3.3.
E8-RM-ML3.3 restricts Trusted Location modifications to privileged macro verification users to prevent unauthorised placement. ISM-1890 requires verification of macros for malicious code before digital signing or location placement, focusing on validation. They overlap in macro processes, with E8-RM-ML3.3 centred on access control and ISM-1890 on pre-placement assurance.
This control supports E8-RM-ML3.1.
E8-RM-ML3.1 requires macros to only execute if sandboxed, in Trusted Locations, or signed by a trusted publisher. ISM-1890 supports E8-RM-ML3.1 by requiring macros to be checked for malicious code before signing or placement in Trusted Locations, enhancing the trustworthiness of these pathways. E8-RM-ML3.1 enforces execution conditions, whereas ISM-1890 ensures macro safety prior to fulfilling those conditions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.