Essential Eight · Restrict Microsoft Office macros
ISM-1487
Only privileged human users responsible for checking that Microsoft Office macros are…
frameworkASD Essential Eight
sectionRestrict Microsoft Office macros
levelsML3
csf 2.0PR.PS-01 PR.PS-05
topics—
frameworks0 0 1
Official textOnly privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-01PR.PS-05 | Configuration management practices are established and applied; Installation and execution of unauthorized software are prevented | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISO 27001 | A.6.7A.8.1A.8.7A.8.8 | Remote working; User endpoint devices… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping+3 more loosely related (not mappings)A.8.19 Installation of software on operational systems Only shares CSF PR.PS-05: related, not a mapping | |
| CIS v8.1 | CIS 2.5CIS 2.6CIS 2.7CIS 4.1 | Allowlist Authorized Software; Allowlist Authorized Libraries… | No mapping. Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping+15 more loosely related (not mappings)CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Only shares CSF PR.PS-01: related, not a mapping CIS 4.3 Configure Automatic Session Locking on Enterprise Assets Only shares CSF PR.PS-01: related, not a mapping CIS 4.6 Securely Manage Enterprise Assets and Software Only shares CSF PR.PS-01: related, not a mapping CIS 4.7 Manage Default Accounts on Enterprise Assets and Software Only shares CSF PR.PS-01: related, not a mapping …and 11 more in the downloads | |
| SOC 2 | CC5.2CC6.7CC6.8CC7.1 | General controls over technology; Restricting transmission, movement and removal of information… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping+1 more loosely related (not mappings) | |
| PCI DSS | 2.2.12.2.25.3.26.4.3 | System configuration standards developed and maintained; Vendor default accounts managed or removed… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| CMMC | CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.3CM.L2-3.4.4 | System Baselining; Security Configuration Enforcement… | No mapping. Only shares CSF PR.PS-01: related, not a mapping+8 more loosely related (not mappings)…and 4 more in the downloads | |
| 800-53 | CM-7AC-19(5)CM-2CM-3 | Least Functionality; Full Device or Container-based Encryption… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping+10 more loosely related (not mappings)…and 6 more in the downloads | |
| HIPAA | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii) | Protection from Malicious Software; Device and Media Controls… | No mapping. Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping+1 more loosely related (not mappings) | |
| GDPR | Art.28(1) | Processor | No mapping. Only shares CSF PR.PS-01: related, not a mapping | |
| NIS2 | 6.36.76.9 | Configuration management; Network security… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| DORA | Art.28(8)Art.30(2) | General principles; Key contractual provisions | No mapping. Only shares CSF PR.PS-01: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 2CE 4CE 5 | Secure Configuration; User Access Control… | No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.