Macros

How does macro apply to Cyber Essentials?

In plain terms

A spreadsheet with a button that builds the monthly sales report at one click is using a macro. That is useful. The same feature lets a fake invoice attachment install malware on the laptop the moment someone opens it. The file looks like an ordinary Word or Excel document, which is why this trick works so well in phishing emails.

What Cyber Essentials asks

The requirements do not use the word macro. Two parts apply all the same. The NCSC definition of software includes "scripts" and "interpreters", and the secure configuration control says you must "disable any auto-run feature which allows file execution without user authorisation". A macro set to run automatically on opening a file fits that description, so it belongs in your answer to A5.8.

Malware protection covers the other side. For Cyber Essentials Plus, the test specification says the assessor's test files must include documents and spreadsheets that contain inert malware samples, sent by email and downloaded through the browser in test case 3.

What an assessor looks for

• A central setting that blocks macros in files from the internet, rather than relying on staff to click the right button.
• Where a team genuinely needs macros, a narrow exception, such as allowing only signed macros or files from a trusted location.
• A short note in A5.8 explaining how macros are controlled.

See the secure configuration requirements and Cyber Essentials Plus test 3. Related: auto-run, malware, phishing.