ASD ISM 1891 Restrict non-V3 signed macros in Microsoft Office
What it says
Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMicrosoft Office can't enable macros signed with old methods via common interfaces.
This control means that only the latest and most secure type of digital signatures, known as V3 signatures, can enable macros in Microsoft Office. This is important because older types of signatures can make it easier for harmful software to sneak in and cause problems, like stealing your data or damaging your files.
Free. Save your status, tasks and notes.
Why it matters
If users can enable macros signed with non‑V3 certificates via Message Bar/Backstage, malicious macros may run, causing compromise and data loss.
How to implement
IT team should update Microsoft Office settings to restrict macros to only those with V3 signatures.
They can do this by accessing Office's security settings and configuring it to trust only V3 signed macros.
System owners should work with the IT team to ensure staff are trained on why only V3 signed macros are allowed.
Conduct a training session explaining the dangers of enabling unverified macros and how this setting helps protect the organisation.
Managers should verify that supplier and partner documents use V3 signatures if they require macro functionalities.
Communicate with suppliers to ensure their documents comply with the V3 signature standard.
The IT team should conduct regular checks to confirm the policy is in place across all computers.
Use a central management tool to review Office settings and verify that only V3 signed macros are enabled.
HR should incorporate macro security training into the onboarding process.
Ensure new employees are aware of the importance of document security and the business's macro policies.
Keep it running
Configure Office/GPO to prevent enabling non‑V3 signed macros via Message Bar/Backstage; regularly test with sample signed macros and audit policy settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Records of Office security configuration: Request documentation showing how Office is configured to allow only V3 signed macros.
Look at
The configuration settings and ensure V3 is the only option enabled.
Good evidence
Is documentation that lists the V3 signature as a requirement in the Office security settings.
- Check 2 of 5What an auditor asks for
Ask for
Records of staff who attended the macro security training.
Look at
Participant names, dates of attendance, and materials covered.
Good evidence
Includes a complete log with all current staff names and recent training dates.
- Check 3 of 5What an auditor asks for
Ask for
A vendor compliance list: Request a list of suppliers who have been informed about V3 requirements.
Look at
The vendor communication records and check that awareness emails have been sent.
Good evidence
Shows that all relevant suppliers are aware of and compliant with the V3 signature requirement.
- Check 4 of 5What an auditor asks for
Ask for
Documented evidence of checks performed on macro usage.
Look at
Logs that show the frequency of macro activations and any blocked macro attempts.
Good evidence
Provides logs detailing blocked attempts due to invalid signatures.
- Check 5 of 5What an auditor asks for
Ask for
An onboarding process document: Request the HR onboarding policy that includes macro security training.
Look at
Clear steps and topics covered in the training.
Good evidence
Includes a comprehensive guide that aligns with the organisational policy on V3 macros.
Mappings
Closest match in ASD Essential Eight: E8-RM-ML3.5, Block enabling of non-V3 signed Microsoft Office macros via Message Bar, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RM-ML3.5.
ISM-1891 requires that Microsoft Office macros signed with signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View. E8-RM-ML3.5 states the same technical restriction using the same Office enablement pathways. The scope and implementation intent are effectively identical, so meeting one would largely satisfy the other.
- E8-RM-ML3.4Untrusted publisher macros cannot be enabled via Message Bar or Backstage ViewPartially overlaps
This control partially overlaps E8-RM-ML3.4.
E8-RM-ML3.4 requires blocking the enabling of macros when the macro is signed by an untrusted publisher via the Message Bar or Backstage View. ISM-1891 similarly blocks enabling via those interfaces, but targets a different signing condition (signatures other than V3), not trust status of the publisher. They overlap on the enforcement mechanism (prevent user enablement through Office UI) but differ in the specific macro-signature acceptance criteria.
This control supports E8-RM-ML1.2.
E8-RM-ML1.2 requires internet-origin Microsoft Office macros to be blocked. ISM-1891 supports this by restricting the ability to enable macros signed with non-V3 signatures via the Message Bar or Backstage View, reducing risky macro enablement commonly associated with externally sourced documents. ISM-1891 is about signature strength/format rather than file origin, so it complements but does not duplicate E8-RM-ML1.2.
This control depends on E8-RM-ML3.1.
E8-RM-ML3.1 enforces macro execution only under trusted conditions (sandbox, Trusted Location, or trusted publisher signature). ISM-1891 supports this by restricting macro enabling with non-V3 signatures via the Office UI, thus strengthening the signed macro pathway by limiting weaker signature types. E8-RM-ML3.1 is signature-agnostic, whereas ISM-1891 imposes a stricter technical constraint on signatures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.