The IT Asset Lifecycle: Stages, Costs and Secure Disposal

Most organisations are careful at the start of an IT asset's life and careless at the end. Somebody approves the purchase, checks the delivery and images the machine. Then the holder leaves, the laptop goes into a cupboard for a year, and eventually it goes out in a box with forty others to whoever offered to collect them.

That is the wrong way round. The start of the lifecycle costs money; the end is where you can lose data, break environmental law and write off assets you could not account for. So this piece walks through every stage but spends most of its time on the last two.

The seven stages at a glance

Stage 1: plan and procure

Procurement decisions set the cost curve for the next four years. The US Environmental Protection Agency's internal PC configuration standard is a useful public example: it sets a four-year lifecycle for agency PCs and tells buyers to choose a configuration that can reasonably meet needs for four years. Every specification you sign off should pass the same test of still being adequate in year four.

Fix two things at purchase, because both are hard to fix later. First, match the warranty or support term to the intended life; a three-year warranty on a machine you plan to keep for four leaves a gap exactly when failures become likely. Second, capture cost, purchase date and supplier on the record the day it arrives, because finance will need them for depreciation.

Stage 2: receive and tag

Every device gets a unique asset tag and a record with its serial number before it goes anywhere. The serial number matters at the far end of the lifecycle too: NIST lists it as one of the fields a sanitisation certificate should record. If you cannot match a serial number to an asset at disposal, you cannot prove that specific device was wiped.

Stage 3: deploy and assign

Issue to a named person, with a date and an acknowledgement. When a device later turns up damaged, missing or overdue for return, the custody record is what tells you who to ask. The onboarding and offboarding guide covers the issue and recovery steps in detail.

Stage 4: maintain and support

Most mid-life cost is batteries, screens, keyboards and accidental damage. Dell, for example, says typical users notice reduced battery runtime after 18 to 24 months and that its batteries carry a one-year warranty as standard. Record actual repair cost against the device every time, because cumulative repair spend is what tells you when to stop repairing.

Stage 5: reassign

A device moving from one employee to another is a mini-disposal. The previous holder's data has to go before the next holder logs in. For a device staying inside the organisation, a clear-level sanitisation (defined below), usually a reset and reimage, is normally proportionate. Record the condition on return and the date of the wipe, so the device's history is unbroken.

How long should a business laptop last?

Published figures cluster around four years. Gartner's analyst Mikako Kitagawa told The Register in 2024 that the average life of a business notebook is four years. The EPA's internal standard sets four years for its PCs. In the same 2024 article, a Dell executive said she wanted to “plant the seed” of a three-year cycle for AI PCs, which tells you which direction vendors would like it to move.

Operating system support is the other driver. Microsoft ended support for Windows 10 on October 14, 2025. Organisations can buy Extended Security Updates for up to three years after end of support, but I would treat that as a paid bridge and nothing more. Hardware that cannot run a supported operating system has reached the end of its useful life regardless of its physical condition.

I would set four years as the default for most office laptops and three for heavy users who travel. Anything beyond five should be a deliberate exception, with the reason written down.

Total cost of ownership: more than the purchase price

Total cost of ownership adds up everything an asset costs from purchase to disposal: the price, set-up time, support and repairs, cover, losses, and the cost of disposing of it securely, minus anything you recover at resale. There is no recent, public study with a transparent method that puts a reliable percentage on each component, so this is a worked example to replace with your own numbers, not a statistic.

Even in this tidy case the lifetime cost is roughly 30% above the purchase price. Add a single lost or stolen device across a fleet and the figure moves sharply; the cost of lost equipment calculator will estimate that for your own fleet.

Depreciation: how the lifecycle shows up in the books

Finance sees the same lifecycle through depreciation, and the useful life finance uses does not have to match the refresh cycle IT uses, or the period the tax authority allows.

• US tax. IRS Publication 946 (2025) classes computers and peripheral equipment (asset class 00.12, Information Systems) as 5-year property under MACRS, with a 5-year ADS period. For tax years beginning in 2026, the section 179 limit is $2,560,000 (Rev. Proc. 2025-32), and a 100% special depreciation allowance applies to qualifying property acquired and placed in service after January 19, 2025, so many US businesses write laptops off for tax in year one.
• IFRS. IAS 16 paragraph 51 requires useful life and residual value to be reviewed at least at each financial year-end. If your laptops are routinely kept for five years against a three-year book life, the estimate is wrong and should change.
• Book versus tax. A four-year straight-line book life alongside a five-year MACRS tax life is normal; the difference is a timing difference your accountant tracks.

For how the method you pick changes the book value at each stage, see straight-line vs written-down value depreciation, or run your own numbers through the depreciation calculator. At disposal, the asset comes off the register, and any proceeds above or below book value are a gain or loss, which is why disposal records matter to finance as much as to IT.

Stage 6: retire

Retirement is a decision, disposal is an action, and the gap between them is where devices disappear. Retire a device on the record the day it is withdrawn, with a reason, and keep it in a locked, logged location until it is sanitised. The UK Information Commissioner's Office says devices awaiting destruction should be stored securely with restricted access, with a log of each device and where it is.

Stage 7: dispose, starting with data sanitisation

NIST Special Publication 800-88 is the reference most organisations cite. As of this writing the current version is Revision 2, published September 26, 2025, which supersedes Revision 1 from 2014. If your policy still cites Rev. 1, update it.

Revision 2 keeps the three sanitisation methods, defined in its glossary:

The bigger change in Rev. 2 is structural. NIST replaced its detailed technique tables with a recommendation to follow IEEE 2883, NSA specifications or an organisationally approved standard, and shifted its emphasis towards running a sanitisation programme: policies, roles, decision criteria and records. Put bluntly, NIST now cares less about which overwrite pattern you used and more about whether you can prove every device was handled.

Rev. 2 also notes that purge can be preferable to destroy where you want to reuse, resell or donate the device, return it under a lease, or avoid the environmental cost of shredding. Sanitisation and recycling are not in tension if you plan for both.

What a certificate of sanitisation should record

NIST SP 800-88r2 says a certificate of sanitisation should be completed for each sanitised device, and lists the minimum fields:

• Manufacturer, model and serial number
• Organisationally assigned property number (your asset tag)
• Media type and source
• Sanitisation method (clear, purge or destroy) and technique
• Tool used, including version
• Verification method
• Name, title, date, location, contact details and signature of the person verifying

One point in the NIST guidance is easy to miss. A certificate is only as valuable as the tracking around it, so records should exist when the device enters the environment, when it leaves its last place of use and when it reaches its post-sanitisation destination. Otherwise you can prove that certain devices were wiped, but not that all of them were.

If an ITAD provider does the work, their certificate becomes your evidence. The ICO says organisations using a third party should have appropriate contracts and should obtain evidence of secure disposal, and that a lack of such evidence may breach UK GDPR articles 5(1)(f), 32 and 5(2).

Some enterprise support contracts let you keep a failed drive rather than return it under warranty. Dell's ProSupport Plus service description includes a Keep Your Hard Drive service, available only on systems with field-replaceable drives. If your policy requires destroying failed media in-house, check for this before a warranty claim sends a drive back unsanitised.

ITAD providers and certification: R2v3 and e-Stewards

IT asset disposition (ITAD) providers collect, sanitise, refurbish, resell and recycle retired equipment. Two certifications dominate in the US and are widely used elsewhere: R2, managed by SERI, now in version 3 (R2v3), and e-Stewards, managed by the Basel Action Network.

The US EPA encourages the use of certified recyclers and says both programmes require destruction of all data on used electronics, alongside environmental, worker-safety and downstream-handling requirements. Under R2v3, SERI says every certified facility must have a data sanitization plan, and facilities certified to its Appendix B carry enhanced data sanitisation requirements.

Before you sign with a provider, ask for its current certificate, its scope (which sites and which appendices) and a sample of the per-device sanitisation report you will receive. If that sample cannot be matched to your asset tags or serial numbers, it will not satisfy NIST's tracking point above.

E-waste law: EU, UK and US

European Union

The WEEE Directive 2012/19/EU requires separate collection and proper treatment of waste electrical and electronic equipment. Since 2019, each member state must collect annually either 65% of the average weight of equipment placed on its market in the three preceding years, or 85% of the WEEE generated on its territory. In July 2025 the European Commission published an evaluation of whether the directive remains fit for purpose; check for revisions before relying on the current text.

United Kingdom

Under the WEEE Regulations 2013, GOV.UK guidance says producers must finance collection and treatment of non-household WEEE from equipment placed on the market on or after 13 August 2005, and of older equipment the business user is replacing with equivalent new equipment, unless the producer and business user have agreed other arrangements. In practice, ask your hardware supplier what take-back route they offer before paying someone else.

Separately, the general waste duty of care applies. GOV.UK says businesses must keep waste transfer notes for two years, and hazardous waste consignment notes for three.

United States

There is no single federal law requiring businesses to recycle electronics. The EPA's regulations page notes that 25 states plus the District of Columbia have electronics recycling laws, and that federal hazardous waste rules under RCRA still apply to some components, such as leaded CRT glass. Coverage and business obligations vary from state to state, so check your own state's rules before choosing a disposal route.

A disposal checklist you can adopt

1. Retire on the record the day the device is withdrawn, with a reason and its current book value.
2. Store securely in a locked, logged location until sanitisation.
3. Decide the method per device: purge if it will be resold or donated, destroy if it is failed or held top-sensitivity data.
4. Remove cloud locks and management enrolment so the next owner can use it.
5. Get a per-device certificate with the NIST minimum fields, matched to your asset tag and serial number.
6. Use a certified route (R2v3 or e-Stewards in the US; a compliant WEEE route in the UK and EU) and keep transfer notes.
7. Close the record: disposal date, route, certificate attached, proceeds recorded for finance.

Where the records live

Every stage above produces a record, and they are only useful if they sit on the same asset. In Stackroom, the asset record holds purchase cost and depreciation settings, the custody history of who held it, maintenance tickets with actual cost, and status changes through to retired. A sanitisation certificate can be attached to the asset as a file, so the evidence sits next to the serial number it refers to. For departing employees, an asset clearance certificate confirms everything they held has come back before the device enters the retire-and-dispose stages. The IT asset management page covers the rest.

Sources

• Personal Computer Configuration and Management Standard (CIO 2122-S-02.3) — US EPA, 2025
• Dell exec reckons AI-powered laptops will shorten refresh cycle — The Register, 2024
• Windows 10 support has ended on October 14, 2025 — Microsoft
• Extended Security Updates program for Windows 10 — Microsoft Learn
• Dell laptop battery FAQ — Dell
• Publication 946 (2025), How To Depreciate Property — IRS
• IAS 16 Property, Plant and Equipment — IFRS Foundation, 2025
• Guidelines for Media Sanitization: NIST Publishes SP 800-88r2 — NIST, 2025
• SP 800-88 Rev. 2, Guidelines for Media Sanitization — NIST, 2025
• Disposal and deletion (records management toolkit) — ICO
• Dell ProSupport Plus for PCs service description — Dell, 2024
• Certified Electronics Recyclers — US EPA
• Core 7 data security vs Appendix B data sanitization — SERI
• Directive 2012/19/EU on waste electrical and electronic equipment — EUR-Lex, 2012
• Waste from electrical and electronic equipment (WEEE) — European Commission
• Electrical and electronic equipment: producer responsibilities — GOV.UK
• Dispose of business or commercial waste: waste transfer notes — GOV.UK
• Regulations for Electronics Stewardship — US EPA