
Essential 8 - Microsoft Office macro settings.
All users should be denied the ability to execute Microsoft Office macros by default unless they have a demonstrated business requirement for their use. In such cases, users should still be restricted to using macros in only the specific applications required for their duties.
In addition, a record of their business requirement, and associated approvals, should be kept.