Retire a device by changing its state to retired, revoking its credentials and update access, and keeping its record. Deleting the row removes your ability to answer later questions, such as which units ran an affected release. Remove the access, keep the history.
Why deletion hurts
An advisory might arrive months after a unit left service. A customer may ask what a returned device ran. An auditor may sample units from last year. If the record is gone, you cannot answer, and a gap in evidence is worse than a long list.
What retirement changes
| Item | Action |
|---|---|
| Inventory state | Set to retired, with date and reason |
| Device credentials | Revoke certificates, tokens, and keys |
| Update access | Remove from rollout target lists |
| Cloud account link | Detach from the owner, or flag as transferred |
| Data on the device | Erase or confirm erased before reuse or disposal |
| Release history | Keep as is |
Steps
- Define the states: active, quiet, retired, transferred, and lost.
- Require a reason and an owner for any move to retired.
- Revoke per device credentials as part of the same change, not later.
- Confirm the device no longer appears in rollout targets, so success rates are not skewed by units that will never answer.
- For hardware that is resold or returned, run your wipe procedure and record when.
- Keep the record for a stated period that your legal and contract rules support. Ask your counsel about the length, since it varies.
Lost and stolen units
A device reported lost is not simply retired. Its credentials need to be revoked at once, and you should check what data and network access it held. Record the report date, since any later activity from its identity is suspect.
Effect on metrics
Retired devices should leave the denominator for coverage metrics but stay in historical counts. Keep the date, so a chart of last quarter still shows the units that existed then.
Components still matter
Retiring devices lowers your exposure for a given release, which can finish a long open vulnerability item. Use the device map to confirm no active units remain on a release, then close the finding with that evidence. Safeguard keeps SBOM based findings tied to releases, so the closure is traceable. The free scan at gold.safeguard.sh/scan is a place to start.
Make it routine
Retirement works best as a standard form with a few fields and a checklist, owned by one team. Without that, devices drift into a gray state: still in the database, no longer in service, with live credentials. Review the quiet list monthly. Anything silent past your window gets a decision, retire or investigate, instead of staying in limbo. Include the check in your offboarding process for customers, too, so devices linked to a closed account do not linger.
Quick check
Should I delete retired devices from the database?
No. Mark them retired and keep the history so later questions can be answered.
When should credentials be revoked?
In the same change that retires the device.
Last reviewed: 19 October 2026.
