Disable or Remove Internet Explorer 11
Ensure Internet Explorer 11 is not used to enhance system security.
Plain language
Disabling or removing Internet Explorer 11 (IE11) means ensuring that people in your organisation can’t use this outdated software. This is important because IE11 no longer gets security updates, making your system vulnerable to cyber attacks if people continue to use it.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Aug 2021
Control Stack last updated
19 Mar 2026
E8 maturity levels
ML1, ML2, ML3
Guideline
Guidelines for system hardeningSection
Operating system hardeningOfficial control statement
Internet Explorer 11 is disabled or removed.
Why it matters
If Internet Explorer 11 remains enabled, its legacy attack surface can be exploited to deliver malware or enable unauthorised access and data loss.
Operational notes
Confirm IE11 is removed/disabled via GPO/Intune and feature management; block iexplore.exe launch, and provide supported browser alternatives to users.
Implementation tips
- IT team should identify all computers that have Internet Explorer 11 installed. They can do this by running a software inventory check across all systems and creating a list of those with IE11.
- System administrators should configure network policies to disable Internet Explorer 11. They can use Group Policy settings to turn off access to IE11 directly from the network control panel.
- IT support staff should educate employees about moving to modern browsers like Microsoft Edge or Google Chrome. They can organise small training sessions to show how to import bookmarks and set up new browser settings.
- Procurement should update the software procurement list to exclude Internet Explorer 11 in new purchases. They can revise documentation to specify only modern, secure browsers must be installed on new devices.
- IT security should monitor and ensure compliance with this control. They can set up alerts to detect if IE11 usage is attempted within the organisation and follow up with necessary actions to prevent its use.
Audit / evidence tips
-
Askthe latest software inventory report
Goodshows no instances of IE11 across all systems
-
Gooda clear policy with the specific entry to disable IE11, dated and active
-
Aska record of employee training sessions about browser migration
-
Goodupdated guidelines with specific instructions excluding IE11 installations
-
Askcompliance monitoring reports or alerts logs. Check these to see if there have been any incidents of IE11 usage attempts and the actions taken
Goodreport indicates either no incidents or appropriate follow-up actions taken immediately
Cross-framework mappings
How ISM-1654 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.
E8
| Control | Notes | Details |
|---|---|---|
| layers Partially meets (1) expand_less | ||
| E8-PA-ML1.9 | ISM-1654 requires Internet Explorer 11 to be disabled or removed | |
| link Related (1) expand_less | ||
| E8-AH-ML1.1 | ISM-1654 requires Internet Explorer 11 to be disabled or removed to reduce exposure to insecure or legacy browsing components | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.