MACRO-ML1 Configure Microsoft Office Macro Settings (ML1)
Microsoft Office macros are disabled for users that do not have a demonstrated business requirement. Microsoft Office macros in files originating from the internet are blocked. Microsoft Office macro antivirus scanning i
8
artefacts
4
held by a system
1
at each review
easy
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Group Policy or Intune ADMX export showing 'Disable all macros without notification' for users not in the business-requirement group · Policy repository / GRC workspace
- Evidence of demonstrated business requirement approval workflow with current approved user list · Identity provider / directory
- AMSI macro scanning evidence (Defender or third-party AV) and version sufficient to scan Office macros · Vulnerability scanner / patch tooling
- Office Trust Center settings export showing user lockdown (HKCU policy keys overridden by HKLM) · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Audit of users in the macro-enabled group reviewed at least annually · Policy repository / GRC workspace
governing documentDocuments that govern the control
- GPO showing 'Block macros from running in Office files from the internet' set to Enabled · Policy repository / GRC workspace
- Sample test: open a macro-enabled file from the internet zone, confirm execution is blocked · Policy repository / GRC workspace
- Office version inventory showing supported builds that honour the policy · Policy repository / GRC workspace
First move
Automate the pull from your Policy repository / GRC workspace. Version-controlled policy set with approval metadata; review dates tracked as records, not a calendar note.
Common gaps auditors find
- Macros disabled by default but no audit of who is in the exception group
- Mark of the Web policy enabled but a downstream tool strips MOTW (file shares, email gateways)
- AMSI scanning not enabled or AV does not support macro AMSI
- Users still able to click 'Enable Content' due to HKCU writeable settings
- Policy applied to Word and Excel but not PowerPoint, Outlook or Visio
- Macro signing not used so legitimate macros require global enablement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetBACKUP-ML3 Regular Backups (ML3) · MACRO-ML2 Configure Microsoft Office Macro Settings (ML2)