Skip to content
arrow_back
ISM-1654
search
ISM-1654 policy ASD Information Security Manual (ISM)

Disable or Remove Internet Explorer 11

Ensure Internet Explorer 11 is not used to enhance system security.

Preventative ML1 ML2 ML3 NC OS P ASD Information Security ManualGuidelines for system hardeninghardeningsoftware install
record_voice_over

Plain language

Disabling or removing Internet Explorer 11 (IE11) means ensuring that people in your organisation can’t use this outdated software. This is important because IE11 no longer gets security updates, making your system vulnerable to cyber attacks if people continue to use it.

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2021

Control Stack last updated

19 Mar 2026

E8 maturity levels

ML1, ML2, ML3

Guideline

Guidelines for system hardening

Section

Operating system hardening

Topic

Hardening Operating System Configurations

Official control statement

Internet Explorer 11 is disabled or removed.
policy ASD Information Security Manual (ISM) ISM-1654
priority_high

Why it matters

If Internet Explorer 11 remains enabled, its legacy attack surface can be exploited to deliver malware or enable unauthorised access and data loss.

settings

Operational notes

Confirm IE11 is removed/disabled via GPO/Intune and feature management; block iexplore.exe launch, and provide supported browser alternatives to users.

build

Implementation tips

  • IT team should identify all computers that have Internet Explorer 11 installed. They can do this by running a software inventory check across all systems and creating a list of those with IE11.
  • System administrators should configure network policies to disable Internet Explorer 11. They can use Group Policy settings to turn off access to IE11 directly from the network control panel.
  • IT support staff should educate employees about moving to modern browsers like Microsoft Edge or Google Chrome. They can organise small training sessions to show how to import bookmarks and set up new browser settings.
  • Procurement should update the software procurement list to exclude Internet Explorer 11 in new purchases. They can revise documentation to specify only modern, secure browsers must be installed on new devices.
  • IT security should monitor and ensure compliance with this control. They can set up alerts to detect if IE11 usage is attempted within the organisation and follow up with necessary actions to prevent its use.
fact_check

Audit / evidence tips

  • AskThe latest software inventory report GoodShows no instances of IE11 across all systems
  • GoodA clear policy with the specific entry to disable IE11, dated and active
  • AskA record of employee training sessions about browser migration
  • GoodUpdated guidelines with specific instructions excluding IE11 installations
  • AskCompliance monitoring reports or alerts logs. Check these to see if there have been any incidents of IE11 usage attempts and the actions taken GoodReport indicates either no incidents or appropriate follow-up actions taken immediately
link

Cross-framework mappings

How ISM-1654 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

E8

Control Notes Details
layers Partially meets (1) expand_less
E8-PA-ML1.9 ISM-1654 requires Internet Explorer 11 to be disabled or removed
link Related (1) expand_less
E8-AH-ML1.1 ISM-1654 requires Internet Explorer 11 to be disabled or removed to reduce exposure to insecure or legacy browsing components

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Mapping detail

Mapping

Direction

Controls