Someone already wrote your macro and application hardening policy. Should your board trust it?

A state government IT team has already built the Group Policy Objects your school needs for two Essential Eight controls, published them for free, and put them on GitHub. Before anyone imports them, there’s a governance question worth asking that has nothing to do with the technical quality of the work.

The two controls, and why they’re usually built from scratch badly

Configuring Microsoft Office macro settings and user application hardening are two separate ASD mitigation strategies that, in practice, both come down to the same mechanism: Group Policy Objects applied across the fleet. Macro settings control whether Office documents can run embedded code, and from where. Application hardening locks down browser behaviour so users can’t quietly weaken settings like advertising blocking or security defaults. Writing correct GPOs for both is fiddly, easy to get subtly wrong, and rarely something a small IT team has a spare week to build and properly test.

That gap is exactly why a ready-made, free package is attractive. It’s also exactly the kind of gap where “someone else already solved this” needs a governance check before it becomes “our policy”, not just a technical import.

Where the free package comes from, and the one thing worth naming to your board

The Western Australian Government’s DGov cyber security team has open-sourced a set of GPOs covering Maturity Level 1 for both controls, hosted on GitHub as wagov/Essential8-GPOs. It’s GPL-3.0 licensed, free to import, and includes a PowerShell script to load the policies into Active Directory. The macro settings component disables macros for users without a demonstrated business need, blocks macros sourced from the internet, enables antivirus scanning of macros, and prevents users overriding those settings. The application hardening component locks down browser advertising blocking and browser security settings so they can’t be user-modified.

The governance point, stated plainly: this is a state government initiative, not an ACSC-endorsed product. The package’s own documentation says as much. It’s sound work, built off ACSC’s own hardening publications, but it isn’t an official Commonwealth deliverable. If a board member or an insurer asks whether the school’s macro and browser hardening controls are “ACSC-endorsed”, the accurate answer is that they’re built on ACSC guidance and sourced from a state government team, not that they carry ACSC’s own endorsement. That distinction matters if the answer ever needs to hold up in an insurance claim or a formal compliance review, and it costs nothing to state accurately from the start.

The fork that actually applies here: your infrastructure, not your licence tier

Most controls in this series fork by Microsoft 365 licence tier. This one forks differently, by whether your school is still running on-premises or hybrid Active Directory, or whether you’re Entra-only. The wagov package is a Group Policy solution, which means it only applies directly if Group Policy is part of your environment. Schools that have moved fully to cloud-managed, Entra-only device management need the equivalent settings delivered through Intune configuration profiles instead, a different build, not covered by this package.

Worth flagging separately: part of the package targets Internet Explorer 11, which Microsoft has already retired and removed from most currently supported Windows builds. If your fleet is on a current, patched Windows version, those specific policies are likely redundant. Importing the whole set without reviewing what’s still relevant to your environment is how a school ends up with dead policy objects nobody remembers the purpose of two years later.

What a Business Manager should ask before this goes into the school’s compliance evidence

If this package ends up cited as evidence of Essential Eight maturity in a board pack, cyber insurance renewal, or funding application, the honest framing is: “built on ACSC guidance, sourced from a WA state government open-source project, tested and imported by our own team.” That’s a defensible position. Representing it as an ACSC product, even by omission, is not, and it’s an easy correction to make now rather than under scrutiny later.

Where this leaves you

Free, well-built tools exist for these two controls, and there’s no good reason to build the equivalent from scratch. The governance work isn’t in the GPOs themselves, it’s in stating accurately where they came from and confirming they actually fit the environment they’re being applied to.

Best Practice - This is the way