Start with the environment, not a shopping list
Build the annual IT plan from an up-to-date inventory of devices, software and services. Record the user or owner, purpose, configuration, purchase date, technical condition, warranty and vendor support end date. Include routers, wireless access points, storage devices and uninterruptible power supplies, not just computers.
Compare the inventory with actual use. An inactive licence, forgotten service or spare device may still need payment or maintenance. Ask process owners about recruitment, new applications and location changes. Equipment age alone does not describe all requirements, and a list copied from the previous year can conceal important changes.
Separate warranty, support and usefulness
Warranty expiry is different from the end of security updates. A working computer may not support a required operating system, while a newer device may still fail a particular application’s requirements. Check the exact product, version and edition against vendor information. Record when this was verified because conditions can change.
Choose a path for each item: maintain, upgrade, repurpose or retire. Consider reliability, performance, parts availability and business importance. Avoid imposing one mandatory replacement age on every device without examining its condition and actual limitations. Record exceptions and the reason for keeping them.
Include implementation and ongoing work
A cost plan should include purchasing, workstation preparation, data migration, security configuration, testing, user familiarisation and retirement of the previous device. For services, record the billing period, user count, coverage and renewal date. Separate one-off work from recurring expenditure so deployment cost is not confused with ongoing operation.
Include supporting resources such as backups, storage, licences, monitoring and support. Use current quotations and the organisation’s actual commitments for amounts. This plan organises technical needs; accounting treatment, taxation and financing require separate decisions by the appropriate people. Keep assumptions visible when an item has not yet been quoted.
Order work by the consequences of delay
Separate urgent, scheduled and development work. Unsupported systems exposed to threats, repeated failures stopping work and inability to restore data will often deserve higher priority. Record the specific reason rather than applying a broad “security” label. Include dependencies: a new application may require earlier computer or network improvements.
Where resources are limited, prepare a minimum viable option and a target option. For deferred work, identify consequences, temporary measures and a review date. Deferral does not remove the risk. Assign the decision to an owner who understands its effect on the business process and can approve the trade-off.
Allow time for delivery and unexpected events
Place tasks in a quarterly schedule covering procurement, delivery, a pilot and rollout. Do not schedule the whole replacement for the day support ends. Account for staff availability and busy business periods. For a larger device group, first test a representative unit with the real applications and accessories.
Agree a reserve for failures and unexpected needs without assuming a universal percentage. Review the plan regularly against actual delivery. Changes in user numbers, application requirements or supplier conditions should update the plan rather than produce an unquestioning repetition of last year’s list. Record owners for revised actions.
Accept the new device and retire the old one
Acceptance covers required applications, transferred data, updates, protected accounts, encryption under company policy and verified backup arrangements. The user should complete a typical task and know where to report a problem. Update inventory records, responsibility and the next review date after handover.
Before passing on old equipment, confirm that required data is retained and use a sanitisation method suitable for the storage medium and its intended destination. Deleting files alone is insufficient. Record the result and recipient. The plan ends with controlled retirement, not merely with a new computer appearing on someone’s desk.
Sources: NCSC New Zealand — Asset lifecycle management · Microsoft Learn — Fixed Lifecycle Policy · Microsoft Learn — Modern Lifecycle Policy · NCSC — Secure sanitisation and disposal of storage media