Lost or stolen company laptop: a first-hour checklist for a small business

The laptop itself is rarely the expensive part. The cost comes from what it can open: e-mail, the shared drive, customer files, saved passwords. What you do in the first hour decides whether that stays closed.

A small company does not need a security team for this. It needs one page that everyone can find, and one person who owns it.

Before it happens: three preparations

• A named contact who receives loss reports, plus a deputy. A phone number, not only an e-mail address.
• Devices under management, even basic management, so that a laptop can be locked or wiped remotely. See a company device inventory.
• A password manager and single sign-on where possible, so that resetting access is a few steps, not a hunt. See a password manager rollout.

Minute 0–10: report it and say who to call

The employee reports the loss to the named contact immediately, by phone. The rule must be clear: reporting quickly is never punished. People who fear blame wait until the evening, and that is the real damage.

The contact asks four questions:

1. When and where was it last seen?
2. Was it locked, and was it switched off or only asleep?
3. What was on it, and which accounts were signed in?
4. Is there a chance it is simply misplaced, for example in the office or a car?

If it was stolen, the employee also reports it to the police and keeps the report number. Insurers and some customers will ask for it.

Minute 10–30: lock or wipe remotely

• Lock the device first. Use your device management tool or the built-in "find my device" feature.
• Wipe it if there is no realistic chance of getting it back, or if it held sensitive data. If it is only misplaced, a lock with a message is enough for a day.
• Remember a wipe only works when the laptop goes online. Keep the order active so it runs when it connects.

Minute 30–50: reset access in a fixed order

Work through the same order every time:

1. Company e-mail and single sign-on account: change the password and sign out all sessions.
2. Password manager: change the master password if the vault was unlocked on the device.
3. Cloud storage and business systems the person used, such as CRM, accounting and the code repository.
4. VPN certificates, API keys and tokens stored on the laptop.
5. Multi-factor methods: remove the lost device from trusted devices and check that the phone is still the employee's.

Do not reset only the password. An active session can stay open without it, so signing out sessions is the step people forget.

Minute 50–60: check encryption and decide how serious it is

Ask one question: was the disk encrypted, and was the device locked?

• Encrypted and locked: the data is very unlikely to be readable. Record this as a loss of hardware.
• Not encrypted, or status unknown: treat it as possible exposure of everything on the disk. Decide with the owner of the business whether customers or authorities must be told, and note the time of that decision.

If personal data of customers or staff was on the device, check your legal reporting duties now. Time limits can be short, and that is a reason to decide early.

What to record

Keep a short log, ideally in the same place for every incident:

• date, time and place of the loss;
• device, user and serial number;
• what was done and when: lock, wipe, resets, police report;
• whether the disk was encrypted;
• what data and accounts the device could reach;
• who decided on any notification, and what they decided.

Afterwards: one short review

Within a week, hold a ten-minute review without blame. What was slow? Was the contact reachable? Was the device list correct? Change one thing. Often it is a missing phone number or an old inventory, as in a post-incident review for internal systems.

Also check that leavers hand in devices and lose access in time; see a new employee access checklist.

Common mistakes

• Waiting to see whether it turns up, while accounts stay open.
• Resetting passwords but leaving sessions active.
• No encryption on laptops, so every loss becomes a possible data breach.
• No up-to-date device list, so nobody knows what was on the machine.
• Blaming the employee, which makes the next report late.

Summary

Name a contact, keep devices manageable, and follow the same order every time: report, lock, reset, check encryption, record. Done in an hour, a lost laptop stays a hardware problem.

Sources

• Common practice for small teams, offered as a practical guide. No client results or market figures are claimed in this article.