Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled…

frameworkASD Essential Eight sectionRestrict Microsoft Office macros levelsML3 csf 2.0PR.PS-01 PR.PS-05 topics— frameworks0 0 1

Official textMicrosoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1675 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-01 PR.PS-05	Configuration management practices are established and applied; Installation and execution of unauthorized software are prevented	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping
ISO 27001	A.6.7 A.8.1 A.8.7 A.8.8	Remote working; User endpoint devices…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping +3 more loosely related (not mappings) A.8.9 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.19 Installation of software on operational systems Loosely related Only shares CSF PR.PS-05: related, not a mapping Clause 9.3 Management review Loosely related Only shares CSF PR.PS-01: related, not a mapping
CIS v8.1	CIS 2.5 CIS 2.6 CIS 2.7 CIS 4.1	Allowlist Authorized Software; Allowlist Authorized Libraries…	Loosely related	No mapping. Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping +15 more loosely related (not mappings) CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.3 Configure Automatic Session Locking on Enterprise Assets Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.6 Securely Manage Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.7 Manage Default Accounts on Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 11 more in the downloads
SOC 2	CC5.2 CC6.7 CC6.8 CC7.1	General controls over technology; Restricting transmission, movement and removal of information…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping +1 more loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.PS-01: related, not a mapping
PCI DSS	2.2.1 2.2.2 5.3.2 6.4.3	System configuration standards developed and maintained; Vendor default accounts managed or removed…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping
CMMC	CM.L2-3.4.1 CM.L2-3.4.2 CM.L2-3.4.3 CM.L2-3.4.4	System Baselining; Security Configuration Enforcement…	Loosely related	No mapping. Only shares CSF PR.PS-01: related, not a mapping +8 more loosely related (not mappings) CM.L2-3.4.5 Access Restrictions for Change Loosely related Only shares CSF PR.PS-01: related, not a mapping CM.L2-3.4.6 Least Functionality Loosely related Only shares CSF PR.PS-01: related, not a mapping CM.L2-3.4.7 Nonessential Functionality Loosely related Only shares CSF PR.PS-01: related, not a mapping CM.L2-3.4.8 Application Execution Policy Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 4 more in the downloads
800-53	CM-7 AC-19(5)CM-2 CM-3	Least Functionality; Full Device or Container-based Encryption…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping +10 more loosely related (not mappings) CM-4 Impact Analyses Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-5 Access Restrictions for Change Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-6 Configuration Settings Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-7(5) Authorized Software — Allow-by-exception Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 6 more in the downloads
HIPAA	§164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)	Protection from Malicious Software; Device and Media Controls…	Loosely related	No mapping. Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping +1 more loosely related (not mappings) §164.316(b)(2)(iii) Updates Loosely related Only shares CSF PR.PS-01: related, not a mapping
GDPR	Art.28(1)	Processor	Loosely related	No mapping. Only shares CSF PR.PS-01: related, not a mapping
NIS2	6.3 6.7 6.9	Configuration management; Network security…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping
DORA	Art.28(8)Art.30(2)	General principles; Key contractual provisions	Loosely related	No mapping. Only shares CSF PR.PS-01: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 2 CE 4 CE 5	Secure Configuration; User Access Control…	Loosely related	No mapping. Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.