When a laptop or corporate device goes missing, speed and consistency matter. Use this checklist to guide your response and reduce the risk of data exposure.
Immediate Actions (First 15–30 Minutes)
Confirm the loss
- Contact the employee to verify the device is not nearby.
- Identify the device type, user, and last known location.
Escalate internally
- Notify IT or the security team immediately.
- Classify the situation as a potential security incident until confirmed otherwise.
Disable access
- Reset the user’s passwords.
- Revoke authentication tokens.
- Terminate active sessions.
- Block VPN or network access if applicable.
Goal: Prevent the device from serving as an entry point into company systems.
Containment Actions (First Few Hours)
Attempt device location
- Check device tracking tools like DriveStrike for last known activity.
- Determine whether recovery is realistic.
Initiate remote response
- Trigger remote lock to prevent immediate access.
- Perform a full wipe if the device is high-risk or unlikely to be recovered.
Many organizations use endpoint security platforms to perform these actions without physical access to the device. The priority is ensuring company data no longer resides on an uncontrolled endpoint.
Risk Assessment
Quickly evaluate the potential impact:
- Was the device encrypted?
- Did it contain regulated or sensitive data?
- Were privileged credentials accessible?
- Was multifactor authentication enabled?
- Could the device access internal systems automatically?
Higher sensitivity = faster escalation.
Documentation
Record the incident while details are fresh:
- Date and time reported
- Device type and assigned user
- Security actions taken
- Wipe/lock status
- Recovery status
- Exposure findings
Good documentation supports audits, investigations, and future process improvements.
Communication
Determine whether additional notifications are necessary:
- Internal leadership
- Legal or compliance teams
- Customers or partners (if required)
- Cyber insurance provider
Clear communication helps reduce organizational risk.
Post-Incident Improvements
After the situation stabilizes, strengthen your defenses:
- Require encryption across all devices.
- Ensure remote wipe is enabled organization-wide.
- Update incident response procedures.
- Improve employee reporting training.
- Review device inventory accuracy.
Every lost device is an opportunity to close security gaps.
Pro Tip: Prepare Before It Happens
The most effective responses are preplanned.
Organizations should define:
- Who can authorize a remote wipe
- Reporting timelines
- Standard containment steps
- Escalation paths
- Documentation requirements
Preparation turns a chaotic event into a controlled process.
Quick Executive Version
Lost Device? Act Fast:
- Confirm the loss
- Disable access
- Locate the device
- Lock or wipe remotely
- Assess data risk
- Document the incident
- Improve controls
Remember: Protecting data matters more than recovering hardware.