A laptop was lost or stolen

Right now

• Lock the laptop remotely, and wipe it if it isn't recovered quickly, using your device management tool or Find My (Apple) or Find my device (Microsoft).
• Sign the owner's accounts out of all sessions, starting with email, single sign-on and cloud storage.

  Browsers on the laptop may stay signed in even when it's locked.

• Check whether the disk was encrypted (BitLocker on Windows, FileVault on Mac).

Contain

• Change passwords that were saved in the browser or a password manager on the laptop, if the manager wasn't locked.
• Revoke anything stored on it that grants access: VPN certificates, SSH keys, API tokens, remembered-device MFA.
• Remove the laptop from your device management and network access lists once wiped.

Investigate

• Check the owner's accounts for sign-ins since the laptop went missing, and look up any unfamiliar IP addresses.

  Open the IOC lookup

• List what data was on the laptop: synced folders, downloads, email cached for offline use.

  Personal data may have been exposed: some laws set short deadlines to notify a regulator (72 hours under GDPR) or the people affected. Bring in whoever handles legal or privacy early.

Recover

• Report a theft to the police and get a reference number: insurers usually need it.
• Set up a replacement with fresh credentials and restore the owner's data from backups or cloud sync.

Afterwards

• Make sure every laptop has disk encryption turned on and is enrolled for remote lock and wipe.
• Write down when it went missing, what you did and when, and whether data was exposed.

Sources and further reading

• ICO: 72 hours, how to respond to a personal data breach (UK)
• Microsoft Intune: Wipe devices
• Apple: Erase a device with Find Devices on iCloud.com
• Google Workspace: Wipe corporate data from a device

This checklist was checked against these public guides, which go into more depth. Bluebench isn't affiliated with them.