STIGQter: STIG Summary: Microsoft Office 365 ProPlus Security Technical Implementation Guide Version: 3 Release: 5 Benchmark Date: 01 Apr 2026:

VBA Macros not digitally signed must be blocked in Excel.

DISA Rule

SV-223311r960963_rule

Vulnerability Number

V-223311

Group Title

SRG-APP-000141

Rule Version

O365-EX-000002

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> "Macro Notification Settings" is set to "Enabled" and select "Disable VBA macros except digitally signed macros" from the Options.

Check Contents

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> "Macro Notification Settings" is set to "Enabled" and "Disable VBA macros except digitally signed macros" from the Options is selected.

Use the Windows Registry Editor to navigate to the following key:
HKCU\software\policies\Microsoft\office\16.0\excel\security

If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD = 4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.

Vulnerability Number

V-223311

Documentable

False

Rule Version

O365-EX-000002

Severity Override Guidance

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> "Macro Notification Settings" is set to "Enabled" and "Disable VBA macros except digitally signed macros" from the Options is selected.

Use the Windows Registry Editor to navigate to the following key:
HKCU\software\policies\Microsoft\office\16.0\excel\security

If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD = 4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.

Check Content Reference

M

Target Key

4099