Network Device Disposal: Routers, Credentials and Records

Network device disposal involves more than taking a router out of the rack. A useful retirement plan connects the physical unit, its configuration and the access it had to your systems. For business routers, switches, firewalls and wireless equipment, start with that relationship before choosing a reuse or recycling route. This guide is a practical workflow for the people coordinating the handover, rather than a substitute for the manufacturer's instructions.

Why does network device disposal need its own checklist?

Network equipment can retain sensitive configuration after it is powered down. The NCSC's network-device guidance recommends addressing certificates, credentials and stored information during decommissioning. Include those access relationships in the retirement record, so a hardware collection does not become the assumed endpoint of a separate security task.

Give the project a named technical owner. The person booking collection may know the unit's location without knowing which service depends on it. Conversely, the administrator replacing the device may assume facilities will dispose of it later. Put the replacement and retirement tasks in the same plan, with a clear handover between the responsible people.

For the wider hardware process, see our IT asset disposal policy template. Add a network-specific section that asks who can approve disconnection, who checks the treatment result and who closes the asset record. Treat unknown answers as questions to resolve, not empty boxes to fill with assumptions.

The NCSC alert on internet-exposed systems and edge devices recommends retiring end-of-life equipment and maintaining an accurate inventory. If a replacement project is on your year-end plan, include the outgoing hardware in the same change record. Replacing a firewall and closing its retirement are separate tasks; agree who owns both.

What should you record before disconnecting equipment?

Record enough to identify the unit and route decisions to its owner: device type, make, model, asset reference, serial number where available, location and intended destination. Add the person responsible for the change. Keep credentials out of the collection list; the list should identify the job without becoming a new store of secrets.

Ask the administrator to confirm whether the unit is owned, leased, supplier-managed or part of a support arrangement. That determines who can authorise work on it. A supplier-managed firewall and an owned office switch may need different approval routes even when they sit in the same cabinet. Save the relevant supplier response with the project.

Keep the retirement list separate from the live configuration backup. Staff arranging the physical collection need handling information and asset identifiers, rather than passwords or private keys. If a technical record is needed for the change, store it in the organisation's approved location and give the disposal file a reference to the responsible owner.

What happens to certificates and credentials?

Ask the network owner to review access relationships independently of the device's physical treatment. The NCSC recommends revoking device certificates and changing or revoking other credentials as appropriate. A reset and a decision about credentials answer different questions, so record both rather than letting one stand in for the other.

Use the change process already in place for the network. The disposal coordinator should not invent a rotation procedure or disconnect a production service to meet a collection slot. Ask the administrator to confirm the approved approach and any dependencies, then mark the hardware ready only when that person has released it.

The closure note can record the change reference, the owner and the outcome without reproducing the secret itself. If an access relationship remains unresolved, keep an exception open and make the next action explicit. This gives the security team a useful question to answer without circulating sensitive configuration to everyone involved in the removal.

Is a factory reset enough for network device disposal?

Assess the reset against the model, storage and intended destination, rather than assuming a generic button sequence covers everything. The NCSC's storage-media guidance notes that reset techniques vary. Ask for the applicable manufacturer procedure and an explanation of how the result will be checked before agreeing the treatment route.

Distinguish a failed unit from a completed reset. If a device cannot power on, do not record the intended procedure as though it ran successfully. Ask the technical owner or processing provider to explain the alternative. Keep the original intention and the actual result together so the change of route is visible to the reviewer.

Our secure data destruction information can help frame an enquiry about data-bearing equipment. Describe the device and known storage configuration accurately. Ask about treatment before booking, particularly for unusual or integrated storage, and avoid promising reuse to another team before the data decision has been agreed.

How do you decide between reuse and recycling?

Agree the equipment's destination alongside a suitable treatment plan. NIST SP 800-88 Rev 2 describes sanitisation controls in relation to information sensitivity. A working device still needs a data decision before reuse; an unwanted device still needs its processing route documented before the retirement job is closed.

Keep the technical and commercial approvals distinct. A reuse recipient may want the hardware, but that does not answer whether it has been released by the network owner. Similarly, a disposal booking should not be treated as authority to destroy a leased or third-party-owned unit. Confirm who can approve the proposed destination and record that decision.

For equipment leaving the organisation as waste, read our business WEEE recycling information when arranging the job. If a provider proposes another destination during processing, route the question back to the named owner. The aim is an agreed, traceable outcome rather than an automatic preference for whichever route is easiest to book.

What should the physical handover include?

Hand over the agreed equipment list, the handling information and a clear description of the requested service. Identify anything awaiting a technical decision so it cannot be confused with released equipment. Keep a record of the handover and ask what processing evidence will follow for any data-bearing devices or media included in the job.

• Keep released units separate from spares and equipment still supporting a service.
• Identify the job owner and provide a route for questions during processing.
• Record discrepancies between the planned list and the equipment actually handed over.
• Ask how an unsuccessful treatment will be reported and who approves an alternative.
• Keep the physical handover record separate from the final processing result.

For projects involving several premises, coordinate the technical release at each site before arranging the wider removal. Businesses seeking computer recycling in Manchester or computer recycling in Birmingham can include network equipment in their enquiry. Specify what is being removed rather than describing every unit simply as a computer accessory.

How do you close the network retirement job?

Close the job after checking the physical outcome, the processing evidence and the network owner's release decision. These can be separate records linked by the asset reference and job identifier. If a discrepancy remains, give it an owner and follow-up action rather than marking the whole batch complete because most units are accounted for.

Ask about asset reporting and certification when agreeing the processing service. At Innovent, the team counts items and labels data-bearing devices with a job number at collection; serial matching takes place at the facility. Reflect that sequence in your file instead of describing collection as a completed serial-level processing check.

A useful final review is simple: can somebody outside the project tell what left, who authorised it, what was done and what remains unresolved? Write a short factual note where the documents need connecting. Keep the record understandable to the next person responsible for the network, rather than relying on the memory of the administrator who replaced the device.

Frequently asked questions