Essential Eight AH-ML3.1 .NET Framework 3.5, 3.0, 2.0 is disabled or removed
What it says
.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure older versions of .NET Framework (3.5, 3.0, 2.0) are turned off or uninstalled.
This control is about making sure that older versions of the .NET Framework, which is a kind of software that helps programs run on Windows computers, are either turned off or completely removed. These older versions can be unsafe because they might have security holes that hackers can exploit to break into or mess up your computer systems.
Free. Save your status, tasks and notes.
Why it matters
Without disabling or removing .NET Framework 3.5/3.0/2.0, systems remain exposed to legacy vulnerabilities that attackers can exploit.
How to implement
IT team should identify computers with .NET Framework 3.5 (which includes versions 2.0 and 3.0) installed by using inventory software to scan all company machines.
System administrator should disable .NET Framework 3.5 on computers by going to Windows Features in Control Panel and unchecking .NET 3.5.
IT team should remove .NET Framework 3.5 from systems where it is not required by uninstalling it through Control Panel or using a command line prompt for batch removal.
Security officer should verify with software vendors whether existing applications require .NET Framework 3.5, and plan upgrades or replacements for dependent applications.
IT team should document the removal process and update system management records to ensure inventory accuracy.
Keep it running
Regularly audit endpoints to ensure .NET Framework 3.5/3.0/2.0 stays disabled/removed, and block re-enablement or reinstall via policy.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Has the organisation disabled or removed .NET Framework 3.5 from all systems?
Look at
Inspect inventory reports that list installed frameworks and check if .NET Framework 3.5 is absent.
Good evidence
Inventory reports confirm no installations of .NET Framework 3.5, or policy documents state it's disabled on necessary systems.
- Check 2 of 2What an auditor asks for
Ask for
What is the process for ensuring .NET Framework 3.5 is not re-installed?
Look at
Check system configuration policies and settings that prevent reinstallation of older frameworks.
Good evidence
Configuration policies are in place that automatically block reinstallation of .NET Framework versions below 4.0.
Mappings
Closest match in ASD Information Security Manual: ISM-1655, Ensure .NET Framework 3.5 is disabled or removed, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
E8-AH-ML3.1 requires a specific secure configuration outcome: disabling or removing legacy .NET Framework versions to reduce the attack surface. Annex A 8.9 requires organisations to establish, document, implement, monitor, and review security configurations across hardware, software, services, and networks, which includes decisions like removing insecure/obsolete components. E8-AH-ML3.1 is a concrete, technology-specific instance of the broader configuration management discipline in Annex A 8.9.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1655.
E8-AH-ML3.1 requires that .NET Framework 3.5 (including .NET 2.0 and 3.0) is disabled or removed. ISM-1655 states the same requirement with the same scope (explicitly naming .NET 3.5 and its inclusion of 2.0/3.0). Implementing E8-AH-ML3.1 would largely satisfy ISM-1655 and vice versa.
This control partially meets ISM-1409.
ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, with the most restrictive requirements taking precedence. E8-AH-ML3.1 maps as a specific OS hardening measure by requiring Windows PowerShell 2.0 to be disabled or removed to reduce attack surface. ISM-1409 is broader because it covers all OS hardening settings and guidance precedence, while E8-AH-ML3.1 focuses on a single legacy component.
- ISM-1470Disable unneeded accounts, components, services and application functionalityPartially meets
This control partially meets ISM-1470.
ISM-1470 requires unneeded components, services and functionality across common user applications (e.g. office suites, browsers, email clients, PDF software and security products) to be disabled or removed to reduce attack surface. E8-AH-ML3.1 is a specific instance of this approach by requiring legacy .NET Framework versions (3.5/3.0/2.0) to be disabled or removed. E8-AH-ML3.1 is narrower and technology-specific, while ISM-1470 is broader and applies across multiple application classes and their optional features/services.
This control partially overlaps ISM-1246.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance with the most restrictive precedence. E8-AH-ML3.1 mandates the removal/disablement of legacy .NET Framework versions, part of server application hardening baselines. E8-AH-ML3.1 focuses on a single technology control, whereas ISM-1246 applies to all server applications.
This control partially overlaps ISM-1621.
E8-AH-ML3.1 requires organisations to disable or remove legacy .NET Framework versions (3.5/3.0/2.0) to reduce the attack surface from outdated components. ISM-1621 similarly requires disabling or removing a legacy Windows component (PowerShell 2.0) to prevent the use of weaker/less-auditable functionality often abused by adversaries. They overlap in intent and approach (removing legacy execution/runtime capability), but they apply to different technologies and do not satisfy each other's specific requirement.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML3.1 requires .NET Framework 3.5 (including .NET 2.0 and 3.0) to be disabled or removed, one component such a baseline takes out.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.