ASD ISM 1654 Disable or remove Internet Explorer 11
What it says
Internet Explorer 11 is disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Internet Explorer 11 is not used to enhance system security.
Disabling or removing Internet Explorer 11 (IE11) means ensuring that people in your organisation can't use this outdated software. This is important because IE11 no longer gets security updates, making your system vulnerable to cyber attacks if people continue to use it.
Free. Save your status, tasks and notes.
Why it matters
If Internet Explorer 11 remains enabled, its legacy attack surface can be exploited to deliver malware or enable unauthorised access and data loss.
How to implement
IT team should identify all computers that have Internet Explorer 11 installed.
They can do this by running a software inventory check across all systems and creating a list of those with IE11.
System administrators should configure network policies to disable Internet Explorer 11.
They can use Group Policy settings to turn off access to IE11 directly from the network control panel.
IT support staff should educate employees about moving to modern browsers like Microsoft Edge or Google Chrome.
They can organise small training sessions to show how to import bookmarks and set up new browser settings.
Procurement should update the software procurement list to exclude Internet Explorer 11 in new purchases.
They can revise documentation to specify only modern, secure browsers must be installed on new devices.
IT security should monitor and ensure compliance with this control.
They can set up alerts to detect if IE11 usage is attempted within the organisation and follow up with necessary actions to prevent its use.
Keep it running
Confirm IE11 is removed/disabled via GPO/Intune and feature management; block iexplore.exe launch, and provide supported browser alternatives to users.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest software inventory report.
Look at
This report to confirm that Internet Explorer 11 is not listed as installed on any computers.
Good evidence
Shows no instances of IE11 across all systems.
- Check 2 of 5What an auditor asks for
Good evidence
A clear policy with the specific entry to disable IE11, dated and active.
- Check 3 of 5What an auditor asks for
Ask for
A record of employee training sessions about browser migration.
Look at
Details showing when sessions were held, how many attended, and the content covered. Good evidence is a dated log of sessions with clear topics and attendance lists.
- Check 4 of 5What an auditor asks for
Look at
These guidelines to verify that there is a policy that bans purchase or installation of IE11.
Good evidence
Updated guidelines with specific instructions excluding IE11 installations.
- Check 5 of 5What an auditor asks for
Ask for
Compliance monitoring reports or alerts logs. Check these to see if there have been any incidents of IE11 usage attempts and the actions taken.
Good evidence
Report indicates either no incidents or appropriate follow-up actions taken immediately.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.1, Disable or remove Internet Explorer 11, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AH-ML1.1.
ISM-1654 requires Internet Explorer 11 to be disabled or removed to reduce exposure to insecure or legacy browsing components. E8-AH-ML1.1 states the same requirement explicitly: Internet Explorer 11 is disabled or removed. Both controls align in scope and intent, and implementing either would largely satisfy the other for this specific requirement.
This control partially meets E8-PA-ML1.9.
ISM-1654 requires Internet Explorer 11 to be disabled or removed. E8-PA-ML1.9 requires removal of multiple categories of unsupported software (including web browsers) when vendor support ceases, which would include Internet Explorer 11 in most environments. ISM-1654 is a specific instance focused solely on IE11, while E8-PA-ML1.9 is broader across many application types and support status conditions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.