A mitigation strategy in the ASD Essentials (currently the Essential Eight), assessed against 4 tests at Maturity Level One.
Macros automate tasks inside Office documents, but they are also a common way to deliver malware. This strategy blocks macros from untrusted sources while still allowing the vetted ones a team genuinely relies on.
Why it matters
Organisations exchange large volumes of documents with customers, suppliers and partners. A macro-enabled spreadsheet from an unknown sender is a classic delivery method, and default settings often let it run.
How Conformance helps
- Block macros in files that come from the internet
- Only allow macros that are digitally signed or from trusted locations
- Identify the small number of business-critical macros and vet them
- Turn on macro antivirus scanning where available
- Log macro execution so you can review what actually runs
Conformance validates this strategy from the evidence your organisation already produces, shows your maturity level, and tells you the next step to raise it.
Official guidance: ASD Essential Eight Maturity Model