Begin With an Inventory
Maintain a current list of organization-owned devices. Include:
- Assigned user or location
- Manufacturer and model
- Serial number
- Purchase date
- Warranty status
- Operating system
- Support status
- Processor, memory, and storage
- Encryption status
- Management status
- Condition
- Repair history
- Planned replacement period
An inventory helps the organization see patterns before individual failures become emergencies. It can also reveal forgotten devices, unsupported systems, missing security controls, and inconsistent purchasing.
Support Status Matters More Than Age Alone
A device should not be replaced only because it reached a particular birthday. Age is one factor, but supportability is more important. Consider whether:
- The operating system still receives security updates
- The hardware supports a current operating system
- Required applications remain compatible
- Replacement parts are available
- The manufacturer still supports the model
- The battery or storage is failing
- Security capabilities meet current requirements
- Performance is adequate for the person's work
Microsoft publishes lifecycle information for supported products and Windows releases. Organizations should monitor those timelines rather than discovering end of support after it has already occurred.
Decide Whether to Repair
Repair may make sense when:
- The device is otherwise supported
- The problem is isolated
- The repair is inexpensive
- Replacement parts are readily available
- The device still meets performance and security requirements
- The repair will provide a reasonable period of additional service
Repair becomes less attractive when failures are recurring, downtime is significant, parts are difficult to obtain, or the device cannot support current security and operating-system requirements.
Decide Whether to Refresh or Upgrade
An upgrade can extend useful life when the device is fundamentally sound. Examples may include:
- Adding memory
- Replacing a slow or failing drive
- Updating the operating system
- Reinstalling a standardized configuration
- Replacing a battery
- Reassigning the device to a less demanding role
Upgrades should not be used to preserve a device that is already unsupported or unreliable. The goal is to use equipment responsibly without creating disproportionate risk or support cost.
Decide When to Replace
Replacement is usually appropriate when:
- The operating system is unsupported
- The hardware cannot run a supported operating system
- Repair costs are too close to replacement cost
- Failures are becoming frequent
- Performance affects the person's ability to work
- The device lacks required security capabilities
- Warranty and parts support have ended
- The device cannot reliably run required applications
- Downtime is more expensive than replacement
- The device no longer fits its assigned role
Use a consistent decision model rather than allowing every replacement to become a separate debate.
Replace in Planned Waves
A staged refresh program is generally easier to manage than replacing everything during a crisis. A planned approach allows the organization to:
- Forecast costs
- Standardize models
- Test configurations
- Prepare users
- Schedule installations
- Reuse appropriate devices
- Avoid replacing every device in one budget year
Devices can be grouped by condition, risk, role, or replacement priority — for example: high-risk or unsupported, performance-constrained, approaching replacement, healthy and supported.
Manage Updates Throughout the Lifecycle
A device is not secure simply because it is relatively new. Operating-system and application updates should be managed and monitored throughout its service life.
Microsoft Intune update rings and feature-update policies can help organizations control how and when supported Windows devices receive updates. A staged approach can test updates with a smaller group before broader deployment.
Reassign Devices Carefully
A device that no longer fits one role may still be useful elsewhere. Before reassignment:
- Confirm it remains supported
- Verify performance for the new role
- Remove the previous user's data
- Reinstall or reset the approved configuration
- Reassign management and security policies
- Update the inventory
- Inspect the physical condition
Do not pass devices informally from one person to another without a documented reset and reassignment process.
Retire Devices Securely
Deleting files or performing a basic reset may not be enough when equipment leaves organizational control. Retirement should include:
- Removing the device from management systems
- Removing organizational accounts
- Recording its final disposition
- Sanitizing storage based on the sensitivity of the information
- Verifying the sanitization process
- Recycling, donating, reselling, or destroying the device through an approved process
NIST's media-sanitization guidance recommends choosing sanitization controls based on the sensitivity of the information and the device's intended disposition.
Use a Lifecycle Policy, Not a Guess
A practical device-lifecycle policy should define:
- Approved standards
- Inventory requirements
- Expected review periods
- Repair thresholds
- Replacement criteria
- Reassignment procedures
- Update requirements
- Data-sanitization requirements
- Disposal documentation
- Budget responsibility
The lifecycle does not need to be identical for every device. A high-performance workstation, shared front-desk computer, executive laptop, classroom device, and network appliance may each require different timelines. The purpose of the policy is consistency in decision-making, not one arbitrary replacement age for everything.
Where to Go Next
Procurement guidance, deployment and device management are part of our managed technology services.
Device decisions connect directly to security and continuity: see Cybersecurity Foundations for Small Organizations and Backup vs. Disaster Recovery, and fold the replacement cycle into your technology roadmap.
Common Questions
How long should an organization keep a laptop?
Judge by supportability rather than age alone: whether it still receives security updates, meets performance needs, and can be repaired at a reasonable cost relative to replacement.
Get the next guide when it is published.
A few thoughtful updates each year — practical guidance, new resources, and important security insights. No spam, no filler.
Related Resources
Choosing a Website Platform for Your Organization
A practical framework for comparing hosted builders, content-management systems, custom development, ownership, cost, accessibility, and long-term maintainability.
4 min readBriefingTechnology Roadmapping for Growing Organizations
How to turn organizational goals, risks, systems, priorities, and timelines into a practical technology plan that can evolve over time.
3 min readField GuideCybersecurity Foundations for Small Organizations
The essential controls every organization should establish first, including identity protection, patching, backups, device security, user awareness, and incident planning.
3 min readHave Questions or Want to Discuss Your Organization's Technology?
We'd love to learn more about your goals and how we can help.
We also run four community programs across Colorado, at no cost to take part — technology help for older adults, technology learning for ages 13–24, records help for veterans, and drop-in help at shelters and day centers. See the programs.