Essential Eight AH-ML1.1 Disable or remove Internet Explorer 11
What it says
Internet Explorer 11 is disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Internet Explorer 11 is not used to increase security.
This control is about stopping the use of Internet Explorer 11 because it is outdated and no longer receives security updates from Microsoft. Without this control, your systems could be more easily attacked by cybercriminals using common hacking tools, putting your data at risk.
Free. Save your status, tasks and notes.
Why it matters
IE 11's lack of security updates makes it an easy target for attackers, potentially leading to data breaches and financial losses.
How to implement
IT team should regularly review and update the list of approved software to ensure Internet Explorer 11 is no longer included.
This involves removing it from any installations or images used in the company.
System administrators should disable Internet Explorer 11 through Group Policy settings.
This can be done by accessing the 'Computer Configuration/Administrative Templates/Windows Components/Internet Explorer' and enabling the 'Disable Internet Explorer 11 as a standalone browser' setting.
Security officers should communicate with employees about the change, informing them of the risks associated with Internet Explorer 11 and guiding them to use newer, supported browsers like Microsoft Edge.
IT team should configure application control to block the Internet Explorer executable file 'iexplore.exe' to prevent it from being launched by standard users, even if it is still present on the system.
Keep it running
Regularly audit endpoints to confirm Internet Explorer 11 is uninstalled or disabled, and block iexplore.exe via policy to prevent re-enablement.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Has Internet Explorer 11 been disabled across all systems?
Look at
Review the Group Policy settings for 'Disable Internet Explorer 11 as a standalone browser'.
Good evidence
The setting is enabled, confirming Internet Explorer 11 is disabled.
- Check 2 of 2What an auditor asks for
Ask for
What measures are in place to prevent users from launching Internet Explorer?
Look at
Check the application control rules for blocking 'iexplore.exe'.
Good evidence
A rule is in place preventing the execution of the 'iexplore.exe' file.
Mappings
Closest match in ASD Information Security Manual: ISM-1654, Disable or remove Internet Explorer 11, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed to reduce known and future technical vulnerability exposure. This supports Annex A 8.8 by acting as an appropriate measure to treat exposure once an organisation has identified IE11 as a technical vulnerability/unsupported component in use. Annex A 8.8 is a broader vulnerability management requirement (identify, evaluate, treat), while E8-AH-ML1.1 is a specific treatment action for one high-risk software component.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1654.
ISM-1654 requires Internet Explorer 11 to be disabled or removed to reduce exposure to insecure or legacy browsing components. E8-AH-ML1.1 states the same requirement explicitly: Internet Explorer 11 is disabled or removed. Both controls align in scope and intent, and implementing either would largely satisfy the other for this specific requirement.
This control partially meets ISM-0380.
E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed to reduce exposure to a legacy, vulnerable browser. This relates directly to ISM-0380 because removing or disabling unneeded operating system components and functionality is the broader hardening practice under which IE11 removal typically sits. ISM-0380 applies across many OS accounts, services and features, whereas E8-AH-ML1.1 is a single, specific software/component removal requirement.
- ISM-1470Disable unneeded accounts, components, services and application functionalityPartially meets
This control partially meets ISM-1470.
ISM-1470 requires disabling or removing unneeded components, services and functionality in common applications to minimise exploitable features. E8-AH-ML1.1 aligns by mandating that Internet Explorer 11 is disabled or removed, which is a clear example of removing an unneeded/legacy browser component. E8-AH-ML1.1 is a single-product requirement, whereas ISM-1470 covers a wider set of applications and their internal functions and services.
This control partially meets ISM-1798.
ISM-1798 requires producing and providing secure configuration guidance for consumers as part of software development. E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed, which is a specific secure configuration/hardening outcome. The candidate is a single prescriptive control for one component, while ISM-1798 is broader and focuses on ensuring guidance exists for secure configuration across software.
This control partially meets ISM-1858.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance if there is a conflict. E8-AH-ML1.1 requires disabling or removing Internet Explorer 11, a specific hardening action aligned to reducing legacy browser attack surface. The candidate is a narrow, technology-specific hardening measure that would typically be implemented under the broader hardening expectations of ISM-1858.
This control partially meets ISM-1915.
E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed as a specific approved hardening outcome. This supports ISM-1915 because removing IE11 is typically part of establishing and maintaining an approved standard configuration for user applications. ISM-1915 is broader, covering governance of approved configurations across all user applications, not just IE11.
This control partially meets ISM-2110.
ISM-2110 requires hardening of user applications in line with ASD and vendor hardening guidance, prioritising the strictest requirement. E8-AH-ML1.1 requires disabling or removing Internet Explorer 11, which is a specific application-hardening action consistent with ASD guidance and would be implemented as part of meeting ISM-2110 for browser/application baselines. E8-AH-ML1.1 is a single-application measure, while ISM-2110 is a general obligation applying across all user applications.
This control depends on ISM-1809.
ISM-1809 requires compensating controls when unsupported systems cannot be immediately removed or replaced, recognising end-of-support technologies as a driver for additional risk treatment. E8-AH-ML1.1 mandates disabling or removing Internet Explorer 11, which is a concrete action to eliminate an unsupported/legacy component and therefore reduce the need for compensating controls under ISM-1809. ISM-1809 is broader because it covers any unsupported system type and focuses on interim protections until retirement, whereas E8-AH-ML1.1 is a specific hardening/removal requirement for one component.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed, one component such a baseline takes out.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.