Restrict Microsoft Office macros

Why this Essential 8 control comes up with insurers

Macro-based phishing remains a leading intrusion method against Australian businesses, so insurers often ask how macros are restricted. If your business does not use Microsoft Office, this control may not apply to you.

Maturity Level 1 — the baseline

Questions worth asking yourself, with the underlying ACSC requirement (November 2023 model) each one reflects:

• Are Office macros turned off for staff who don't have a genuine business need for them?

  ACSC requirement: “Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.”

• Are Office macros in files downloaded from the internet (including email attachments) blocked from running?

  ACSC requirement: “Microsoft Office macros in files originating from the internet are blocked.”

• Does your antivirus software scan Office macros?

  ACSC requirement: “Microsoft Office macro antivirus scanning is enabled.”

• Are staff prevented from changing macro security settings themselves?

  ACSC requirement: “Microsoft Office macro security settings cannot be changed by users.”

Maturity Level 2 — the common target

Questions worth asking yourself, with the underlying ACSC requirement (November 2023 model) each one reflects:

• Are Office macros blocked from making low-level Windows system calls (Win32 API)?

  ACSC requirement: “Microsoft Office macros are blocked from making Win32 API calls.”

Maturity Level 3 — advanced

Questions worth asking yourself, with the underlying ACSC requirement (November 2023 model) each one reflects:

• Can macros only run if they're digitally signed by a trusted publisher, stored in a Trusted Location, or sandboxed?

  ACSC requirement: “Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.”