Re: Mandatory 5 year minimum.
I'd agree in terms of security updates, but OS upgrades are a bonus (remember that you're trying to define the minimum acceptable standard, not a "good case").
I'd expect some upgrade path, but I wouldn't necessarily expect kit that hasn't been sold for the last 4 years to be able to run the latest version of whatever OS is on it. I *would* expect security update to be backported.
Biting the hand that feeds IT
