Restrict Microsoft Office macros
Block macros from the internet, allow only trusted or vetted macros, and stop users from changing macro settings. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 4 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1488 | Microsoft Office macros in files originating from the internet are blocked. | ML1, ML2, ML3 | A.5.14 CC6.8 DE.CM-09 |
| ISM-1489 | Microsoft Office macro security settings cannot be changed by human users. | ML1, ML2, ML3 | — |
| ISM-1671 | Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement. | ML1, ML2, ML3 | — |
| ISM-1672 | Microsoft Office macro antivirus scanning is enabled. | ML1, ML2, ML3 | — |
Maturity Level Two · 5 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1488 | Microsoft Office macros in files originating from the internet are blocked. | ML1, ML2, ML3 | A.5.14 CC6.8 DE.CM-09 |
| ISM-1489 | Microsoft Office macro security settings cannot be changed by human users. | ML1, ML2, ML3 | — |
| ISM-1671 | Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement. | ML1, ML2, ML3 | — |
| ISM-1672 | Microsoft Office macro antivirus scanning is enabled. | ML1, ML2, ML3 | — |
| ISM-1673 | Microsoft Office macros are blocked from making Win32 API calls. | ML2, ML3 | — |
Maturity Level Three · 11 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1487 | Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations. | ML3 | — |
| ISM-1488 | Microsoft Office macros in files originating from the internet are blocked. | ML1, ML2, ML3 | A.5.14 CC6.8 DE.CM-09 |
| ISM-1489 | Microsoft Office macro security settings cannot be changed by human users. | ML1, ML2, ML3 | — |
| ISM-1671 | Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement. | ML1, ML2, ML3 | — |
| ISM-1672 | Microsoft Office macro antivirus scanning is enabled. | ML1, ML2, ML3 | — |
| ISM-1673 | Microsoft Office macros are blocked from making Win32 API calls. | ML2, ML3 | — |
| ISM-1674 | Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute. | ML3 | — |
| ISM-1675 | Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. | ML3 | — |
| ISM-1676 | Microsoft Office’s list of trusted publishers is validated at least annually. | ML3 | — |
| ISM-1890 | Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations. | ML3 | — |
| ISM-1891 | Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View. | ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight