PR.PS-03 hardware maintenance and disposal: NIST CSF

What PR.PS-03 hardware maintenance and disposal requires in NIST CSF 2.0

PR.PS-03 asks that hardware be maintained, replaced and removed in proportion to risk. In practice, the organization must keep devices supported and working, replace hardware that lacks the security capabilities it needs or cannot run the software it must run, plan for end-of-life support and obsolescence, and dispose of equipment securely and in a way that leaves an audit trail. The Subcategory sits in the Platform Security (PR.PS) Category of the PROTECT Function. It absorbs part or all of CSF 1.1 PR.DS-3 (asset disposal) and PR.MA-1 (maintenance), so teams that tracked those 1.1 items should move their evidence to PR.PS-03 when they map to 2.0. NIST publishes three Implementation Examples for this Subcategory, and they are the most useful starting point for a gap review.

Three problems make this outcome hard in practice. The first is an incomplete hardware inventory, because an organization cannot plan replacement for devices it does not know it owns, including network gear, printers and devices managed by a business unit. The second is unsupported equipment kept in service because replacing it is expensive or disruptive, which leaves the risk unmanaged rather than accepted. The third is disposal without records, where drives are wiped or devices collected by a contractor and no one can show what left the building, when, or how the data was destroyed. A useful first check is to compare the hardware inventory against vendor support dates and the disposal log for the last two or three refresh cycles. Open-source inventory tools such as GLPI (Assets module) and Wazuh (Syscollector) can supply the device list, but the organization must confirm that its own asset data is complete and current.

NIST does not certify or assess organizations against CSF 2.0 and has no plans for a conformity assessment program, so no one issues a PR.PS-03 certificate. The organization owns the assessment. Internal teams can test the outcome by sampling devices against support records and disposal certificates, and an independent assessor can review the same evidence if a customer or regulator asks for it. Any independent review is the assessor's conclusion, not a NIST determination. Before the review, confirm which Implementation Examples and informative references the organization has adopted, and document the risk decisions behind each replacement or retention, because those decisions are what an assessor will ask to see.

Which hardware, teams and third parties PR.PS-03 reaches

PR.PS-03 applies wherever the organization maintains, replaces or removes hardware that handles its data or supports its services. The scope questions below decide which devices, teams and providers sit inside the outcome, and each one shifts who signs off and how much evidence must be kept.

Endpoints and servers

Laptops, desktops, workstations and physical servers are usually the first in scope because they hold data and run software that needs patching. The owner is typically IT operations or platform engineering, with security reviewing replacement decisions. Once in scope, each device needs a recorded age, support status and replacement trigger, and a disposal record when it leaves service. Check that your asset inventory is the source of truth for these records, not a spreadsheet kept by one team.

Network and security appliances

Firewalls, routers, switches and VPN gateways often run firmware that vendors stop supporting on a fixed schedule. Ownership usually sits with network engineering, and the decision to replace is often driven by a security capability the device cannot provide. Bringing these into scope means tracking firmware end-of-support dates, planning replacement before support ends, and confirming that configurations are migrated securely. Ask whether your appliance vendor publishes support end dates and how far ahead.

OT and embedded devices

Industrial controllers, building systems, medical devices and other embedded hardware frequently cannot be replaced on an IT refresh cycle. The owner is often operations or engineering, and replacement may require plant downtime, vendor approval or safety review. Placing these devices in scope means documenting which ones cannot run required security capabilities, recording compensating controls while they remain, and setting a replacement plan. Confirm with operations which devices have no supported upgrade path.

Storage media holding data

Hard drives, solid-state drives, tape, removable media and the storage inside copiers or printers can retain sensitive data after a device is retired. Responsibility usually falls to IT asset disposal with data protection staff setting the sanitization standard. Once in scope, every media item needs a documented wipe, destruction or reuse decision, with a chain-of-custody record. Ask who holds the disposal evidence and how long it is retained.

Hardware run by cloud or managed providers

Physical hardware behind cloud accounts or managed service contracts may be operated by someone else, yet the organization still owns the outcome for its data. The decision is contractual: who replaces, retires and sanitizes hardware, and what evidence the provider returns. Adding these services to scope means reviewing provider end-of-life notices and disposal attestations, and writing those duties into contracts. Confirm whether the provider's disposal evidence can be shared with your assessor.

Devices leaving for repair or resale

Equipment sent to a repair vendor, returned under warranty, or sold or donated is where data exposure and unrecorded custody most often occur. Ownership sits with asset management, with procurement and legal involved in the vendor terms. Including these devices means sanitizing or removing storage before departure, logging each handoff, and confirming that the receiving party commits to secure handling. Check whether your repair contracts allow storage to leave the premises intact.

How an assessor tests PR.PS-03 and what passes

This table compares each assessor test area for PR.PS-03 with the evidence requested and the findings that most often fail. Read it as a checklist of what an independent assessor will ask to see, since the test is whether hardware is maintained, replaced and removed in proportion to risk, not whether a particular tool is in place.

Test area	Evidence requested	Common findings
Hardware records against live assets	Hardware inventory export, a sample of records traced to devices on the network, and the discovery method used to keep records current	Inventory lists devices that are no longer in service, or live devices with no record, owner or location
Replacement decisions for devices that cannot run security functions	Documented decisions for devices lacking required security capabilities, with risk rating, compensating controls and approved replacement dates	Unsupported devices stay in production with no recorded risk decision or compensating control
End-of-life dates and follow-on plans	Vendor support dates by model, a life cycle plan with owners, and budget or change approvals tied to each date	End-of-life dates are not tracked, or the plan does not say what happens when support ends
Disposal records against chain of custody	Sampled disposal tickets, certificates of data sanitization or destruction, custody handoffs and vendor documentation where a third party disposed of the asset	Records stop at the decision to dispose, with no proof of sanitization or a gap between pickup and destruction
Proportionality to risk	Risk ranking used to prioritize maintenance, replacement and removal, and evidence that high-risk devices receive earlier attention	Every device is treated the same regardless of exposure, data held or criticality
Exceptions and approvals	Exception register with named approvers, expiry dates and review records	Exceptions have no expiry, or approvers lack authority to accept the risk

Implementing PR.PS-03 step by step

This sequence turns PR.PS-03 from a policy statement into a working cycle: know what hardware you run, judge it by security capability and support status, set replacement rules, approve retirements, and dispose of devices with records an assessor can follow. Each step ends with an artifact you can show.

Build a hardware inventory with named owners
Start by listing every physical device that stores, processes or transmits your data or connects to your networks, including servers, endpoints, network equipment, storage arrays, firmware-bearing peripherals and mobile devices. Record make, model, serial number, location, firmware or BIOS version and the business owner accountable for each item. Asset management under ID.AM supplies the source of truth, and an inventory tool such as GLPI's Assets module can hold it. The output is an inventory extract with an owner on every line, reviewed by the owning teams. Confirm that discovery covers devices your agents cannot reach, such as network gear and printers.
Classify devices by security capability and support status
For each inventoried device, record whether it can still meet the security needs of the workloads it runs. Ask whether it supports current encryption, secure boot, authenticated management, supported firmware updates and the logging you require, and whether the vendor still issues security updates. Mark devices that cannot run needed security software or that have passed end-of-life. Wazuh's Syscollector can supply operating system, installed software and update data for endpoints, which helps confirm support status. The output is a classified inventory that shows each device's capability gaps and support dates, signed off by the platform owner.
Set replacement and end-of-life rules by risk
Define the rules that decide when a device is replaced. Tie them to risk: devices that hold sensitive data, sit on exposed network segments or cannot receive security fixes should move up the replacement queue, while lower-risk assets follow a longer cycle. Write the criteria for lacking needed security capabilities, for being unable to run required software, and for approaching end-of-life support. Include the vendor support calendar as an input and confirm the dates directly with each vendor. The output is an approved replacement standard and a risk-ranked replacement plan that names each device, its trigger and its owner.
Approve a retirement and replacement workflow
Route replacement and removal decisions through a documented workflow. A request names the device, the trigger from the replacement standard, the business impact of taking it out of service and the data it holds. Security, the asset owner and, where relevant, the service owner approve the change before work starts. Record the approval, the planned date and any compensating controls kept in place until the device is removed. The output is a retirement record for each device, which later links to the disposal evidence. Ask your change management tool or ticketing system to keep these records with the inventory entry.
Define the disposal method and its records
Choose a disposal method for each data class and device type before any hardware leaves service. Options usually include wiping and reimaging, cryptographic erasure, physical destruction and return to a vendor under a contract that requires data removal. Write a disposal procedure that states who performs the step, how data removal is verified and what is recorded, including serial numbers, method, date and the person responsible. Where a third party collects or destroys equipment, confirm the contract requires a certificate of destruction or erasure. The output is an approved disposal procedure and a template for disposal records.
Dispose of hardware and keep signed records
Execute the approved procedure for each device and capture the evidence as it happens. Retain the sanitization log, the verification result, chain-of-custody documents for collection and, for outsourced disposal, a signed disposal certificate that names the serial numbers received. Mark the inventory entry as retired and link the record to the retirement approval. The output is a complete file for each device that traces from inventory to removal. Ask an independent assessor which format and retention period they expect, because the framework does not set one.
Review the cycle and feed results back
Check the process on a regular schedule you set. Compare the inventory with what was actually disposed of, look for devices past their support dates that have no approved plan, and confirm that disposal records match the inventory. Use the findings to update the replacement standard, the classification criteria or the disposal method. Record the review, its findings and the changes made, which supports the improvement work under ID.IM. The output is a review record and an updated plan that show the cycle is running and that gaps are closed.

Evidence that satisfies PR.PS-03 and how to keep it current

An assessor testing PR.PS-03 looks for records that show hardware is maintained, replaced and removed in proportion to risk, not a policy that says so. The cards below name the artifacts that carry that proof and the routine that keeps each one current between audits.

Hardware inventory with owner and support status

The inventory is the starting point for every other artifact. Each device record should carry an accountable owner, the vendor support end date, and whether the device can still run the security functions the organization relies on. Export the inventory on a fixed schedule, with the date and the exporting user recorded, and have the asset owner confirm each entry. Check that devices received through procurement or repair appear within the same review cycle. A stale inventory fails the test before any other evidence is read.

End-of-life and replacement plan

This plan shows how the organization decides when hardware leaves service. It lists each hardware class, its vendor end-of-support date, the replacement target, and the budget owner who approved the timing. Review it at each planning cycle and after any vendor announcement that changes a support date. Confirm that replacement dates were set from risk, meaning devices that cannot run required security capabilities are prioritized over devices that merely age. Record the approver and the date of approval on every revision.

Risk acceptances for devices kept past support

Some devices will remain in service after vendor support ends because they run a required application or sit in a constrained environment. Each one needs a written risk acceptance that names the device, the compensating controls, the business reason, the expiry date and the accepting executive. Review open acceptances at each risk review, and close them when the device is replaced or the compensating controls change. An acceptance without an expiry date is a gap an assessor will raise, because it turns a temporary exception into a permanent one.

Change tickets for hardware swaps

Each hardware replacement, upgrade or removal should pass through the same change process used for other production changes. The ticket records the device being changed, the reason, the approver, the rollback approach, and the validation performed after installation. Link the ticket to the inventory record so the old and new entries reconcile. Sample tickets against the inventory each quarter to confirm that every swap has both sides recorded. Tickets that are closed without an inventory update are the most common reason inventory and change records disagree.

Disposal and sanitization records

Before a device leaves the organization, its storage must be sanitized or destroyed and the action recorded. The record names the device serial number, the method used, the person who performed it, the date, and whether the media was reused, recycled or destroyed. Keep the record with the inventory entry and mark the asset as retired only after the record is complete. The organization owns this evidence even when a third party performs the work, so confirm that the record is produced for every unit, not only for batches. Retention periods for these records should follow the organization's own policy and any contractual or regulatory terms that apply.

Vendor certificates of destruction and periodic reviews

When a disposal vendor handles equipment, the organization should hold a certificate of destruction that lists the units received and the method applied to each. Reconcile the certificate against the list of units shipped, and investigate any unit not accounted for. The periodic review is the control's own check: an owner, usually in IT operations with security concurrence, reviews the inventory, support dates, open acceptances and disposal records against each other and signs the result. Confirm the vendor's certificate format and the reviewer's signature authority before the first disposal batch.

What meeting PR.PS-03 costs in money and effort

This table lists the cost components of maintaining, replacing and disposing of hardware under PR.PS-03, who is paid for each, whether it recurs, and what drives it up or down. No figures are supplied for these costs, so ask for line-item quotes built from your own asset counts, refresh schedules and disposal volumes before comparing options.

Cost component	One-time or recurring	What drives it and how to keep it down
Inventory tooling or licenses	Recurring (subscription or support) plus one-time setup	Asset count and agent deployment effort drive cost. Self-hosted GLPI, whose Assets module covers computers, network equipment, printers and racks, and Wazuh Syscollector, which gathers hardware and OS details, can remove license spend, but you still pay for hosting, staff time and any paid support.
Engineering and asset-team time	Recurring	Time to reconcile inventory with procurement records, tag devices and maintain lifecycle fields. Keep it down by automating discovery and tying asset records to purchasing and change tickets.
Replacement capital spending	One-time per device, recurring across refresh cycles	Number of devices that lack required security capabilities or cannot run supported software, and the refresh schedule you set. Open-source tooling does not reduce hardware purchase cost, so model replacement by risk tier and stagger it.
End-of-life tracking upkeep	Recurring	Number of vendors and models, and how often vendor support dates are checked. Keep it down by recording end-of-support dates in the inventory and reviewing them on a fixed cadence.
Certified disposal services	One-time per disposal batch	Volume, location, data sensitivity and whether the vendor issues certificates of destruction. Ask providers to state their certificate format and audit trail in the quote.
Sanitization tooling	One-time or recurring if licensed	Mix of media types and whether sanitization is done in house. Open-source wiping utilities can reduce license spend, but verification and record keeping still need staff time.
Assessor or independent review time	Recurring at each assessment cycle	Depth of sampling of disposal records and inventory accuracy. Assessors test evidence, so clean records reduce review hours. Only independent assessors issue reports; an implementation partner prepares the evidence.

Open-source tools that produce PR.PS-03 inventory evidence

PR.PS-03 asks an organization to know what hardware it runs, when that hardware reaches end of support and when it leaves service. Inventory tools can supply the first and part of the second, which makes them the starting point for the evidence an assessor will request. The two cards below cover the tools most often used for this purpose, with the limits each one has for hardware lifecycle work.

GLPI Assets module

The Assets module records computers, monitors, software, network equipment, peripherals, printers, phones and racks. Staff can enter items by hand, or the GLPI Agent can push device data automatically through native inventory, which GLPI has included since version 10. The GLPI project is licensed under GPL-3.0-or-later. For PR.PS-03, the useful fields are model, serial number, location, assigned owner and status, because these let you link each device to a replacement decision or a disposal record. Confirm with the GLPI documentation that your device types, including rack hardware and telephony equipment, are covered by the asset types you plan to use.

Wazuh Syscollector inventory

The Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, running processes, services, users and groups, and Windows updates from each monitored endpoint. It stores that data in the Wazuh indexer, where the dashboard shows inventory views and reports. The Wazuh project is licensed under GPL-2.0-only. For PR.PS-03, the value is a current, machine-reported view of which hardware runs which operating system and patch level, so you can spot devices that can no longer receive vendor updates. Confirm which hardware attributes and endpoint platforms Syscollector reports in your environment before relying on it for replacement planning.

Separate disposal records

Neither GLPI nor Wazuh is a disposal system. Neither tool records the chain of custody, the data sanitization method, the certificate of destruction or the approval for a write-off, and an assessor will look for those records under PR.PS-03. Keep a documented disposal process that ties each asset identifier from the inventory to a sanitization record, a transfer record and a final disposition. Ask your disposal vendor, or your own team, to confirm how the sanitization evidence will reference the asset ID used in GLPI or Wazuh.

Coverage checks before reliance

Before you cite either tool as PR.PS-03 evidence, test coverage against your actual estate. Compare the inventory export with procurement records and a physical or network sweep, and list devices that appear in one source but not the other. Gaps usually sit in out-of-band management cards, network appliances, printers and older operational technology. Document these checks with dates and owners, and ask each vendor to confirm supported device types and agent requirements for your environment.

Who owns PR.PS-03 and what is worth outsourcing

Your organization owns the hardware lifecycle decisions that PR.PS-03 describes. Those decisions sit with people who know the asset estate, the business services that depend on each device, and the risk the organization will accept. Outsourcing can help build the tooling, but it cannot take over the decisions themselves, and an assessor will ask who approved each replacement or disposal.

Inventory ownership: Named staff keep the hardware inventory accurate, decide which discovered devices are in scope, and resolve gaps between the inventory and what the network actually shows.
Replacement decisions: Internal owners decide when hardware lacking needed security capabilities or unable to run supported software is replaced, and they record the risk reasoning behind any deferral.
End-of-life planning: Platform and business owners set the dates they plan to act on, based on vendor support statements and their own tolerance for unsupported equipment.
Disposal approvals: A designated approver signs off each disposal, confirms that data-bearing media was handled as policy requires, and keeps the record that links the device to its disposal certificate or witness.
Policy and exceptions: Your team writes the rules for hardware maintenance and approves exceptions with an expiry date.

Confirm that each of these responsibilities has a named owner in your own policies, not only in a partner's project plan.

Where organizations fall short on PR.PS-03 and how to close each gap

PR.PS-03 asks that hardware is maintained, replaced and removed in proportion to risk. The gaps below tend to appear at the same points in the hardware life cycle: when a device enters the estate, when it reaches end of support, and when it leaves. Each card names the gap and the check that closes it.

Hardware missing from the inventory

Devices that were never recorded cannot be assessed for security capability, support status or replacement. Shadow equipment, loaner laptops and network gear added during projects are common causes. Reconcile the asset register against what is actually connected, and make a recorded asset a precondition for any device joining the network. GLPI's Assets module can hold computers, network equipment and racks, and its native inventory can populate records automatically through the GLPI Agent.

End-of-life devices without a replacement date

A device past vendor support may still run in production with no owner, budget line or target date. PR.PS-03 expects hardware to be replaced in proportion to risk, which requires a planned end-of-life date for each device class. Record the vendor support end date for every asset, flag those within a set window, and assign each flagged item a replacement date and an accountable owner.

Unsupported devices kept without a risk decision

Some systems cannot be replaced quickly, such as industrial controllers or medical equipment. Keeping them is acceptable only when someone has accepted the risk in writing. The record should state the compensating controls, such as network segmentation, restricted access and enhanced logging, plus a review date. Ask whether each exception has an approver outside the team that runs the device.

Disposal handled by a vendor without certificates

Hardware often leaves through a recycler or leasing company whose handling is never verified. Contracts should require the processor to provide certificates of destruction or recycling for each batch, identify the facility and state how chain of custody is kept. Check that the vendor's certificate lists serial numbers or asset tags, so each disposed item can be matched to a record in your inventory.

Data-bearing storage leaving without sanitization records

Drives, flash memory and backup appliances can retain data after a device leaves the organization. Each item containing storage should go through a documented sanitization method, with the method, the operator, the date and the asset tag recorded before the device is released. Confirm that the method matches the sensitivity of the data stored on the device and that the record is kept with the disposal file.

Inventory never reconciled with live discovery

A static register drifts from the network within months as devices are added, moved or repurposed. Compare the asset register with discovery data from endpoint agents or scanners on a regular schedule, and investigate every mismatch. Wazuh's Syscollector module collects hardware, operating system and network interface data from each endpoint, which can be checked against the asset register during each review.

How much effort PR.PS-03 takes and whether you can do it in-house

How long and how much effort does PR.PS-03 take to meet?

The effort depends mainly on how many hardware assets you run and how accurate your asset inventory is today, and no fixed figure applies to every organization. PR.PS-03 asks you to maintain, replace and remove hardware in proportion to risk, so the work has three parts: deciding which devices must be replaced because they lack needed security capabilities or cannot run supported software, setting end-of-life plans, and documenting secure disposal. An organization with a complete, current inventory and an existing replacement cycle needs far less effort than one that must first find out what hardware it owns. Ask any provider to break the quote into inventory work, risk decisions, procedure writing, and disposal evidence, and to state which of those are one-time and which recur each year.

Can a small IT team handle PR.PS-03 without outside help?

A small team can usually cover PR.PS-03 in-house if it has a reliable asset list, a named owner for hardware lifecycle decisions, and a documented disposal route. The harder part is consistency: someone must review end-of-life dates, approve replacements, and keep disposal records every time a device leaves service. Open-source asset management such as GLPI can hold the inventory, and its Assets module covers computers, network equipment, printers, phones and racks, entered manually or pushed by the GLPI Agent. Outside help is most useful for the initial inventory clean-up, the risk criteria, and a review before an audit. Confirm with any provider whether they will leave you with procedures and records your own staff can keep running.

What does the work require from staff?

The work requires four kinds of people: someone who owns the hardware lifecycle, technicians who keep the inventory accurate, a risk owner who decides which devices are replaced or retained, and whoever signs off on disposal. Technicians need to record hardware changes when they happen, not at quarterly reviews. Risk owners need enough technical knowledge to judge whether a device can still receive security updates or run required controls. Disposal staff need a process that produces a record for each item, including serial numbers, data sanitization method and the disposal vendor's certificate. Ask providers how they will train these roles and which steps they expect your staff to carry out themselves.

Can an assessor test PR.PS-03 without a consultant?

Yes. An independent auditor or assessor can test PR.PS-03 without a consultant, because the test depends on evidence the organization already holds. The assessor will typically ask for the hardware inventory, the criteria used to decide replacement, end-of-life plans, and records showing that retired devices were disposed of securely and traceably. A consultant is not required to produce those records, but a consultant may help you prepare them so they are complete and consistent. Remember that the assessor issues any finding, not the consultant. Confirm with the assessor which evidence they expect and what sample size they will use.

Does NIST certify that our PR.PS-03 work meets the framework?

No. NIST does not certify organizations, products or services against the Cybersecurity Framework, and it has no plans for a conformity assessment program. Any claim that a vendor or consultant has certified your PR.PS-03 implementation as NIST compliant should be questioned. Alignment with CSF 2.0 is demonstrated through your own documented outcomes and, if a customer or regulator requires it, through an assessment by a party they accept. NIST's CSF FAQs describe how the framework is used and why it is voluntary for most organizations. Ask any provider to put in writing exactly what they will deliver and who will issue any report.

Which parts of PR.PS-03 should we outsource first?

Outsource first the work that is hardest to do quickly and least likely to need continuous judgment: the initial inventory reconciliation, the design of the replacement and end-of-life criteria, and the disposal procedure with its evidence template. Keep ownership of routine decisions such as approving individual replacements and signing disposal records, because those depend on your business context. Where DeployOpen is engaged, the scope would be agreed in writing before work starts, and the deliverables would be systems, procedures and evidence your team can operate. DeployOpen does not issue audit reports or certifications. Ask for the scope in writing, including what the vendor will hand over and what you must keep running.

How DeployOpen scopes and prepares PR.PS-03 evidence

DeployOpen works on PR.PS-03 as a fixed-scope implementation partner inside your own infrastructure. We set up the inventory, lifecycle and disposal records that show hardware is maintained, replaced and removed in proportion to risk, while your organization keeps ownership of the control and of the decisions behind it.

How we scope

Agree in writing which hardware classes, sites and asset owners fall inside the PR.PS-03 scope.
Confirm which replacement, end-of-life and disposal decisions your organization makes itself and which we configure.
Define the evidence your assessor will ask for, such as inventory exports, retirement tickets and disposal certificates.

How we build

Configure GLPI Assets so hardware records, owners, life cycle status and retirement dates are tracked in one place.
Deploy the GLPI Agent and Wazuh Syscollector so hardware and operating system data is collected from endpoints automatically.
Build reports that flag hardware approaching end-of-life support or lacking required security capabilities for review.

How we hand over

Document the procedure for replacing, retiring and disposing of hardware, including who approves each step.
Provide inventory reports, retirement records and a mapping from PR.PS-03 to the evidence it produces.
Walk your control owners through the evidence so they can answer assessor questions without us present.

How we support

Offer ongoing support and upgrades as a retainer after handover, if your organization wants them.
Review the inventory and end-of-life reports as your hardware estate changes, and update the records accordingly.
Confirm with your auditor which evidence formats they accept, since only independent assessors issue conclusions on the control.