ASD ISM 2111 Remove temporary installation files post-installation
What it says
All temporary installation files created during user application installation processes are removed after user applications have been installed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove all temporary installation files created during user application installation once the application has been installed.
When software is installed, the installer extracts setup files, scripts and other temporary artefacts onto the machine. This control requires those temporary installation files to be deleted once the application is in place. Leftover installer artefacts can contain embedded credentials, helper scripts or extracted payloads that an attacker can read or reuse, so removing them shrinks the attack surface on each endpoint.
Free. Save your status, tasks and notes.
Why it matters
If temporary installation files are left behind after an application is installed, those artefacts can contain embedded credentials, configuration secrets, installer scripts or extracted executable payloads. An attacker or malicious insider who reaches the host can read these for credential harvesting, or reuse leftover binaries and scripts to escalate privileges or maintain persistence, increasing the attack surface on every affected endpoint.
How to implement
Add a cleanup step to each application package and deployment script that deletes the installer's temporary files once installation succeeds, targeting the user and system %TEMP% directories and any vendor-specific extraction or staging folder used by that installer.
Bake installer-artefact removal into the standard operating environment (SOE) build so newly provisioned endpoints never ship with leftover setup files.
Prune the Windows Installer cache (C:\Windows\Installer) of orphaned or superseded staged packages, using a supported tool such as PatchCleaner-style validation so that only entries still referenced by installed products are retained.
Configure endpoint management or configuration management tooling (for example Intune, SCCM/Configuration Manager, Group Policy, Jamf) to periodically scan for and remove residual installer extraction directories across the fleet.
Require third-party installers and managed service providers, through the contract or statement of work, to remove their installer temporary files after installation, and verify removal as an acceptance criterion before sign-off.
After packaging a new or updated installer, test on a clean host to identify exactly where it stages temporary files, then update the cleanup step so the removal stays accurate as vendors change their installers.
Keep it running
Identify where each installer stages temporary files, such as the user and system %TEMP% directories, the Windows Installer cache (C:\Windows\Installer), and any vendor-specific extraction or staging folders, then confirm these are cleared once installation completes. Bake the cleanup step into your standard operating environment (SOE) build and into application packaging so removal happens automatically rather than relying on manual deletion. Use endpoint management or configuration management tooling to detect and remove residual installer artefacts on an ongoing basis, and re-confirm cleanup after each new package or installer version is introduced, since vendors change where and how they stage files.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for a sample of recently deployed user applications and access to the host filesystem on the endpoints where they were installed.
Look at
Inspect the user and system %TEMP% folders, the C:\Windows\Installer cache and known vendor staging folders for each sampled application.
Good evidence
No temporary installation files remain on the sampled hosts after the applications have been installed.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the application packaging or deployment scripts and the SOE build documentation.
Look at
Check whether a cleanup step that deletes installer temporary files is defined and configured to run automatically on completion of the install.
Good evidence
Every package or deployment script includes an automatic cleanup step that removes installer temporary files once installation finishes.
- Check 3 of 5What an auditor asks for
Ask for
Ask for deployment or configuration management logs covering the sampled installations.
Look at
Confirm the cleanup action ran and completed successfully for each sampled installation rather than being skipped or failing silently.
Good evidence
Logs show the cleanup step executed and succeeded for every sampled installation, with any failures raised and resolved.
- Check 4 of 5What an auditor asks for
Ask for
Where third parties install software, ask for the contract, statement of work or acceptance criteria and the corresponding acceptance records.
Look at
Look for a clause requiring removal of installer temporary files and evidence that acceptance testing verified this was done.
Good evidence
Third-party agreements require removal of installer temporary files and acceptance records show this was verified before sign-off.
- Check 5 of 5What an auditor asks for
Ask for
Ask for recent endpoint management scan results or compliance reports.
Look at
Check that hosts are routinely scanned for residual installer artefacts and that any findings are tracked to remediation.
Good evidence
Scans run regularly, residual installer files are detected when present, and records show they are remediated promptly.
Mappings
Closest match in ISO/IEC 27001: A.8.10, Secure deletion of information when no longer needed, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.10.
ISM-2111 requires removing temporary installation files after user applications are installed to reduce residual artefacts on systems. ISO/IEC 27001:2022 Annex A 8.10 requires secure deletion of information when no longer needed, which can include installation leftovers that are no longer required once installation completes. Annex A 8.10 applies broadly to all information types and retention contexts, whereas ISM-2111 is focused specifically on installer-generated temporary files and the post-installation step.
This control partially meets A.8.19.
ISM-2111 requires that temporary installation files created during user application installs are removed after installation. ISO/IEC 27001:2022 Annex A 8.19 requires secure software installation procedures across operational systems, which commonly includes controlling install artefacts such as temporary files and caches. ISM-2111 is a specific post-install clean-up requirement, while Annex A 8.19 is broader and covers the overall governance and safeguards for installing software.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.