◇ OpenCyber Academy
Technologist · Chapter 24 · English

Chapter 24 — Hardware lifecycle and supply

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Hardware lifecycle and supply

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Replacement"]
  N2["24.2 Buying"]
  N3["24.3 Disposal"]
  N4["24.4 Donated devices"]
  N5["Firmware support and warranty"]
  N6["Budgeting and reuse"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Replacement"]
  N2["24.2 Buying"]
  N3["24.3 Disposal"]
  N4["24.4 Donated devices"]
  N5["Firmware support and warranty"]
  N6["Budgeting and reuse"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Replacement]
    |
    v
[24.2 Buying]
    |
    v
[24.3 Disposal]
    |
    v
[24.4 Donated devices]
    |
    v
[Firmware support and warranty]
    |
    v
[Budgeting and reuse]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) plan device replacement; (2) buy secure hardware; (3) dispose safely.

24.1 Replacement

Devices go out of support when the vendor stops updates. Tomás uses support dates from the inventory to plan replacements over three years, prioritising laptops that cannot run the current Windows version.

Laptops that cannot run the current Windows version will stop receiving security updates, so they come first regardless of their condition. Tomás groups the remaining laptops by support end date from the inventory, which gives the order and timing of the three yearly batches without guessing.

24.2 Buying

Purchase criteria include a TPM 2.0, Secure Boot, vendor firmware update support for at least five years and compatibility with the management service. CIS Controls and NIST SP 800-193 support choosing hardware that can protect and recover its firmware.

These criteria come directly from earlier findings: a laptop without an enabled TPM delayed encryption, and the outdated firmware showed why vendor support length matters. Compatibility with the management service means a new laptop is enrolled and receives the baseline on first start, rather than being configured by hand.

24.3 Disposal

Disposed devices are wiped following NIST SP 800-88 guidance, with certificates from the recycler recorded against serial numbers.

Solid-state drives are erased with the vendor's secure erase, since overwriting does not reliably reach every part of the drive. The certificate from the recycler is matched to the serial number in the inventory, and a device is marked disposed only once its certificate is on file. The four laptops recycled earlier without records show why that step cannot be skipped. The serial and certificate together let the trust answer a regulator's question about any disposed laptop.

24.4 Donated devices

Donated laptops must meet the same criteria and be enrolled before use.

Two donated laptops had appeared in no list during the inventory work, which is exactly the risk this rule addresses. A donated laptop is wiped, checked for a TPM 2.0 and Secure Boot, enrolled in the management service and recorded in the inventory before anyone uses it. One that cannot meet the criteria is politely declined or passed on for recycling with a certificate. Recording the donor and date alongside the serial also helps the business manager acknowledge donations correctly.

Firmware support and warranty

Vendors publish how long each model receives firmware and driver updates. Laptops past that date may still run Windows, but no longer get fixes for low-level flaws. Tomás adds firmware support end dates and warranty end dates to the inventory and uses them, with operating system support, to set replacement order. Warranty matters because repairs after it expires often cost more than a replacement. When comparing models for purchase, he asks vendors for the support period in writing, because marketing pages change, and records the answer in the purchasing file so it can be checked later.

Budgeting and reuse

Spreading replacements over three years keeps yearly spending even, which suits a schools trust whose budget is set annually. Tomás presents the plan with a simple yearly cost line and the risk of delaying each group, so leaders can make an informed decision if money is short. Old laptops that still receive updates are not left in cupboards, where they would miss updates and become forgotten risks. Instead they are reused for less sensitive tasks, such as library catalogue stations, enrolled in management like every other device, and retired when their support ends.

Worked example

The plan replaces 18 laptops this year, 30 next year, and the rest after.

Synthetic case. Figures are synthetic.

Errors and limits

Buying cheapest devices can mean shorter firmware support and earlier replacement.

Exercises

Synthesis

Planning the hardware lifecycle prevents unsupported devices accumulating.

Continue studying — chapter 24 of 30

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →