A missing laptop creates two problems at once: you have lost a piece of equipment, and you may have lost control of business data and active sign-in sessions. The first hour should be about reducing uncertainty and cutting off access—not searching for the receipt.

Whether the laptop disappeared from a car, an airport, a hotel, or an employee’s home, the response should be predictable. Encryption, device management, identity controls, and a simple reporting process make the difference between an inconvenience and a serious data-exposure event.

What to focus on first

Report it immediately

The employee should contact the designated IT/security contact as soon as the device is known to be missing. Waiting until the next business day can leave active sessions and cached credentials exposed.

Lock or retire the device in management tools

Use MDM or endpoint-management tools to mark the device lost, restrict access, or initiate a remote wipe when appropriate. Preserve enough information to identify the correct device before taking destructive action.

Revoke sessions and review sign-ins

Force sign-out from cloud accounts and check for unusual authentication activity. If the device had saved browser sessions or tokens, changing only the password may not be sufficient.

Confirm encryption status

Full-disk encryption dramatically reduces the risk that data can be read directly from a stolen drive. Organizations should know encryption status before a device goes missing, not discover it during the incident.

Document what data and applications were accessible

Determine whether the device stored regulated or sensitive information locally and which cloud systems it could reach. This helps leadership decide whether legal, insurance, customer, or regulatory notifications are necessary.

Common ways this goes wrong

• Allowing employees to delay reporting because they hope the device will turn up.
• Using shared local accounts or devices that are not enrolled in centralized management.
• Assuming a Windows or macOS login password alone protects data on an unencrypted drive.

Make it part of normal operations

Make the control part of normal device and user lifecycle work: deployment, patching, support, role changes, and retirement. The process should work for remote employees as well as people in the office. Standardization is what makes a small IT team effective; every exception creates future support and security work, so exceptions should have an owner and an end date.

Questions worth bringing to your next IT review

• Can we explain how the ‘Report it immediately’ practice works today without relying on one person’s memory?
• Where do we have exceptions to ‘Lock or retire the device in management tools’, and are those exceptions still necessary?
• Who owns the work behind ‘Revoke sessions and review sign-ins’, and what evidence shows it is working?
• How would we discover that this control or process stopped working?
• What business, staffing, vendor, or technology change should trigger another review?

What a solid approach looks like

The best lost-device response is built before anything goes missing: managed devices, encryption, strong authentication, clear ownership, and a short incident checklist. When those controls are in place, IT can make fast decisions without guessing.

If you want to go one level deeper, see Cloud Security Basics.

If your organization would benefit from help reviewing the current environment or turning these ideas into a workable plan, Computer and Server Remote Support from CTResources is available as a practical next step. The goal is to strengthen what matters without adding unnecessary complexity.