Hi @Simon94995
EOL statements are never as clear as they ought to be. e.g. does "SW" also include "firmware"?
The patch releases don't discriminate between hardware and virtual appliance installations. This means that as long as Cisco produces patches for the release that's already running on your 35xx servers, you'll be fine. Of course those patches will eventually dry up (e.g. ISE 2.2). And sadly, even if the "older" 35xx hardware could run 2.7/3.0 software, you won't have any luck trying to install it, because it won't succeed. The only way to stay future proof is to avoid the hardware and go with VMs instead. As long as you maintain your hypervisor infrastructure you'll be fine (i.e. don't expect to run latest ISE on ESXi 5.0 ... )
Hardware appliances also have the additional hassle of CIMC firmware to consider - the challenge with ISE and CIMC is that you are bound by a limited number of images that will allow ISE to SAFE Boot. The CIMC doesn't change that often and quite often it's best to leave it alone. If you can access the KVM via html (and not needing Java JRE 1.6) then you're doing well. Older CIMC's were a real pain to work with (Java ...).