Does your organization have a formal process to replace hardware that lacks required security capabilities or cannot support secure software?

Hardware lifecycle security is the focus, asking whether you have a formal process to replace hardware that lacks required security capabilities or cannot run secure software. This includes outdated servers, workstations, network devices, IoT devices, or specialized equipment that cannot be properly secured through updates or security controls.

Evidence could include a documented hardware lifecycle management policy that specifically addresses security requirements, replacement criteria, and timelines; hardware inventory records showing security capability assessments; and documentation of recent hardware replacements due to security concerns.