This question already has an answer here:
Absolute beginner question: If I assume that my contract is complex and will need future features or bugfixes, and that it holds assets and records privileged addresses, how should I prepare for an upgrade?
Should I include a function that disables the contract and transfers all the assets and addresses to a new contract? To plan in advance, what other arguments should this function accept? How should I manage the authority to execute this upgrade - hard-code my public-key? Or should I try to separate out a "back end" with business logic, and leave the front end to find the correct back-end? How should I deal with users attempting to execute the contract after it's been made obsolete?