APP.1.1 Office Products

The automatic execution of embedded active content MUST be disabled. If it is nevertheless necessary to run active content, care MUST be taken to ensure that active content is only run when it comes from trusted sources. All users MUST be instructed about features that restrict active content.

All documents obtained from external sources MUST be scanned for malware before they are opened. All file formats considered problematic and those not required within an organisation MUST be prohibited. They SHOULD be blocked if possible. Technical safeguards SHOULD be implemented to enforce the scanning of documents from external sources.

Appropriate efforts MUST be taken to make all users aware of the threat posed by active content. Appropriate efforts MUST also be taken to make all users aware of how documents from external sources are to be handled.

Users SHOULD be informed about the capabilities and limits of the security functions of the software employed and the storage formats used. Users SHOULD be trained on the features they can use to protect documents from subsequent modification and editing.

Users SHOULD be made aware of how the encryption functions in Office products are to be handled.

New versions of Office products SHOULD be tested for compatibility with established tools such as macros, document templates, or organisation forms prior to productive use (see OPS.1.1.6 Software Tests and Approvals). It SHOULD be ensured that important tools will continue to function as they should with each new software version. If compatibility issues are detected, appropriate solutions SHOULD be found for the tools affected.

For software development based on Office applications (e.g. with macros), binding regulations SHOULD be established (see also APP.1.1.A2 Limiting Active Content). First, every organisation SHOULD make a policy decision as to whether or not it wants to allow in-house development of this kind by end users at all. The decision SHOULD be documented in the corresponding security policies. If custom developments are permitted, a process for handling corresponding features of the Office products SHOULD be created for the end users. Responsibilities SHOULD be clearly defined. All information pertaining to the applications created SHOULD be documented. Current versions of the regulations SHOULD be made available to and observed by all affected users in a timely manner.

All add-ons and extensions for Office products SHOULD be tested in the same way as new versions prior to productive use. This testing SHOULD only be carried out on isolated test systems. The tests SHOULD check if the extensions have any adverse effects on the Office products and IT systems in operation. The tests of the extensions in use SHOULD follow a defined test plan. This test plan SHOULD be designed in such a way that third parties can understand the procedure.

The cloud storage features integrated into some Office products SHOULD be disabled as a matter of principle. All cloud drives SHOULD be disabled. All documents SHOULD be stored by users on file servers centrally managed by the organisation. Specialised applications SHOULD be used to share documents with third parties. These applications SHOULD at least encrypt the storage and transmission of data and have a suitable system for user and rights management.

Data from potentially unsafe sources SHOULD be automatically opened in a protected mode. Users SHOULD NOT be allowed to disable this feature. A list of trustworthy places from which content can be opened and edited directly SHOULD be defined.

In the protected mode, it SHOULD NOT be possible to edit data directly. Active content such as macros and scripts SHOULD NOT be executed automatically in the protected mode. Only general navigation SHOULD be allowed. When documents are only to be viewed, appropriate viewer applications SHOULD be used if available.

Depending on their intended use, documents SHOULD be suitably protected against subsequent modification.

Data that requires increased protection SHOULD only be stored and transmitted in encrypted form. Before using an encryption method integrated into an Office product, it SHOULD be checked to ensure that it offers sufficient protection. In addition, a process SHOULD be used that supports the digital signing of macros and documents.

When storing or transmitting data that requires increased protection, appropriate integrity checks SHOULD be used. Cryptographic procedures SHOULD also be used for data that requires protection against manipulation.