Does your organization have a formal process to replace hardware that lacks required security capabilities or cannot support secure software?

This question assesses whether your organization systematically evaluates and replaces hardware that cannot meet security requirements, either due to inherent hardware limitations or inability to support necessary security software. This includes outdated servers, workstations, network devices, IoT devices, or specialized equipment that cannot be properly secured through updates or security controls. Evidence could include a documented hardware lifecycle management policy that specifically addresses security requirements, replacement criteria, and timelines; hardware inventory records showing security capability assessments; and documentation of recent hardware replacements due to security concerns.