PR.PS-03 says hardware is maintained, replaced, and removed commensurate with risk. Laptops, phones, servers, and network gear age out of security support. This outcome asks you to plan for that, and to wipe and document devices when they leave.
CSF is voluntary guidance with no certification.
What good looks like
You know the support end date for each hardware model. Devices that cannot run supported software or lack needed security features are replaced on a plan. Disposal is secure, responsible, and leaves a record.
How to implement it
- Add model, purchase date, and vendor support end date to your asset inventory.
- Set a refresh cycle, commonly three to five years for laptops, and flag anything past it.
- Check each year that devices still receive firmware and operating system updates.
- Use a standard offboarding and disposal process: encrypt at rest, wipe with a documented method, and get a certificate of destruction from any disposal vendor.
- Record the serial number, date, method, and person responsible.
What this looks like at small scale
Most small companies do not own much hardware, and the main exposures are laptops, phones, and a few network devices. A practical plan has three parts. Keep an inventory with support end dates. Replace on a schedule, or when a device can no longer run a supported operating system. Wipe and record everything that leaves.
Secure disposal in practice
A device that is simply thrown out or handed to a recycler may still hold readable data. Use full disk encryption from the start, so a lost or discarded device is much less of a risk. At end of life, wipe using a documented method, and keep a log with serial number, date, method, and who did it. When a vendor handles disposal, ask for a certificate of destruction and file it. Do the same when staff leave and return equipment: collect, wipe, and log it before reissuing.
Obsolescence planning
Check each year which models are nearing the end of vendor support for firmware and security updates, and which cannot run software with the security features you need, such as hardware backed encryption. Put replacements in the budget a year ahead so you are not forced into an emergency purchase.
Evidence to collect
- Inventory with support end dates.
- Refresh plan or budget line.
- Wipe logs and disposal certificates.
Common gaps
Old routers and switches running unpatched firmware. Laptops of departed staff sitting in a drawer with data intact. Disposal done informally with no record.
Quick check
Are employee laptops in scope?
Yes. They are hardware the organization owns or manages, and they need support tracking, replacement, and secure wiping.
Sources
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), PR.PS-03 and its implementation examples.
