ASD ISM 1655 Ensure .NET Framework 3.5 is disabled or removed
What it says
.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain English.NET Framework 3.5 should be turned off or uninstalled for security reasons.
.NET Framework 3.5 might seem like just some software that helps run certain programs on your computer, but it's not supported for the newest security updates. This means it can leave your computer open to hackers, who could steal your data, mess up your system, or compromise your business operations if they're able to exploit these security holes.
Free. Save your status, tasks and notes.
Why it matters
Leaving .NET Framework 3.5 enabled risks exploitation of unpatched vulnerabilities, leading to potential data breaches and business disruptions.
How to implement
The IT team should identify all computers and servers running .NET Framework 3.5 by using inventory management software to scan for installed software versions.
Make sure to report the findings in a clear and detailed list.
The IT team should evaluate which applications still rely on .NET Framework 3.5 and work with application owners to upgrade these to newer versions or alternative software that don't require .NET Framework 3.5.
Document these discussions and update plans in a project management tool.
System owners should coordinate with the IT team to schedule a convenient time to disable or remove .NET Framework 3.5 on each machine identified.
This is done through the control panel and may involve using scripts for batch processing.
The IT team should ensure they have a backup of all necessary data and system settings before making any changes by using automated backup tools.
This ensures there's a way to restore systems if anything goes wrong during the removal process.
Managers should inform all staff about potential disruptions during removal and who to contact for support if they experience issues post-removal.
Use emails and internal communication platforms to send out these notifications.
Keep it running
Verify via Windows Features/PowerShell that .NET Framework 3.5 is disabled/removed on all hosts during quarterly reviews.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest software inventory report: Request to see the list of installed software versions on all organisational devices, focusing on entries for .NET Framework 3.5. Look if .NET Framework 3.5 is listed and whether it has been removed or disabled.
Good evidence
Documented list shows .NET Framework 3.5 is no longer active on any devices.
- Check 2 of 5What an auditor asks for
Ask for
Project plans or change requests: Request the document that outlines how applications depending on .NET Framework 3.5 are being updated.
Look at
Timelines, assigned responsibilities, and completion status.
Good evidence
The plan is detailed, with all dependencies reviewed and updated actions in progress or completed.
- Check 3 of 5What an auditor asks for
Ask for
System backup records: Request to see the logs that confirm backups before changes were made.
Look at
Whether backups were successful and complete.
Good evidence
Logs indicate all systems were backed up completely before any removal operations began.
- Check 4 of 5What an auditor asks for
Ask for
Communication records: Request emails or memos sent to staff about system changes.
Look at
Clear instructions and contact details provided.
Good evidence
Communication clearly outlines what changes are happening, why they're necessary, and support contact information.
- Check 5 of 5What an auditor asks for
Ask for
To see any remediation steps documented post-removal: Request records of any issues encountered after the removal and how they were resolved.
Look at
Responses and outcomes of any disruptions.
Good evidence
Issues are documented with clear follow-up actions taken swiftly to resolve them.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML3.1, .NET Framework 3.5, 3.0, 2.0 is disabled or removed, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AH-ML3.1.
E8-AH-ML3.1 requires that .NET Framework 3.5 (including .NET 2.0 and 3.0) is disabled or removed. ISM-1655 states the same requirement with the same scope (explicitly naming .NET 3.5 and its inclusion of 2.0/3.0). Implementing E8-AH-ML3.1 would largely satisfy ISM-1655 and vice versa.
This control partially overlaps E8-AH-ML3.2.
E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 to reduce attack surface and weaken common living-off-the-land techniques. ISM-1655 requires disabling or removing .NET Framework 3.5, another legacy component often kept for compatibility. Both controls reduce exposure by removing deprecated Windows components, but they apply to different technologies and neither control inherently satisfies the other.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.