How do you keep business computers and phones updated, and when should you replace them?

Ascent Vision · Published October 30, 2026

Turn on automatic updates on every computer and phone where you can, keep one list of your devices and apps, and check once a month that updates actually installed. CISA advises replacing hardware or software that is no longer supported, because it stops receiving security updates. Look up each device's support end date and plan its replacement before that date arrives.

CISA's three steps

CISA says outdated software is one of the most significant security risks to a business, because criminals target known weaknesses and updates are what fix them. Its page on updating business software gives three steps. It is written with an IT team in mind; a business without one can give the same jobs to an owner or a support provider.

Patch and update automatically. Have automatic updates turned on where possible, including operating systems, applications and third-party software.
Replace what is no longer supported. Hardware or software that is no longer supported does not get security updates. CISA advises keeping an up-to-date inventory of authorized devices and applications and removing or replacing any that are outdated or unauthorized.
Get staff to take updates seriously. CISA advises reminding staff, especially remote workers, to turn on automatic updates on all devices and software, restarting devices regularly, paying attention to update notifications and checking with IT before installing new apps on company devices.

A one-page device list

The list is a simple way to keep the inventory CISA advises. One row per device is enough, with a second list for the apps the business depends on. Fill in the last column from the maker's own support page for that model or system.

Device	Who has it	Bought	Supported until	Automatic updates on?
Laptop	Office manager	Month and year	From the maker's support page	Yes or no
Phone	Owner	Month and year	From the maker's support page	Yes or no
Router	Office	Month and year	From the maker's support page	Yes or no

A monthly check

NIST's small business guide says it may be useful to assign a day each month to check for patches, and to know how to update every piece of software on each device you use. It also advises checking for updates immediately on a new computer and when installing new software.

Restart any device that has an update waiting.
Open each phone and tablet and check that its system and apps are current.
As general advice, include the router and any other device the business depends on; CISA's page cites a group attacking public-facing devices such as routers and firewalls at businesses in critical infrastructure sectors.
Update the list: new devices, people who left, devices handed on.

When to replace a device

A device is due for replacement when its maker stops providing security updates for it. NIST notes that vendors are not required to provide security updates for unsupported products, and advises using only a current, vendor-supported version of the software you choose. Makers usually publish how long a model or system is supported, which is why the list has a column for it.

As general advice, plan the replacement before the date rather than after: put the support end date on the list, move devices holding customer information first, and back up before the switch (the related answer on backing up business data covers how). NIST advises wiping the drives of old computers before you sell, throw away or donate them. The related answer on website maintenance covers the website, and the related answer on managed IT support covers having a provider handle updates.

Sources

Ongoing technical support

The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.

See the service Work with us