Lost or stolen laptop: the first hour, in order

A lost laptop is two incidents at once: a physical loss (insurers, police, replacement hardware) and an access incident (every session, token, cached password, and SSH key that rode out of the coffee shop in someone's backpack). Teams that treat it as only the first one get burned by the second. The order below is designed so that access gets revoked before you spend an hour on paperwork — the thief cannot be slowed down by your forms, so revoke first.

1. The first 10 minutes: facts, then revocation

• Confirm the basics and write them down: whose device, when last seen, where, whether it was locked. You're building a timeline you'll need for police, insurers, and (if customer data lived on it) your notification assessment. Notes now beat reconstruction at 11pm.
• Reset the user's identity first: rotate the password on the identity provider (Google Workspace, Microsoft 365, or your SSO) and sign the user out of all sessions. On Google: Admin console → User → Security → Sign out. This kills the mail, drive, and SSO sessions in one move.
• Revoke MFA devices and app passwords for that user — the laptop may hold an enrolled authenticator or an app password that keeps working after the password changes.
• Try the remote controls immediately, in this order: locate/lock (Find My, Microsoft Entra device actions, MDM) and then remote wipe. Wipe takes a while; starting it now is what makes it finish.
• Revoke network access: disable the device certificate or VPN account, and remove the laptop's entry from your WiFi/zero-trust tooling. A wiped-but-online laptop with a valid VPN cert can still be a door.

2. Assume the disk is readable (because it might be)

• Verify disk encryption status, don't assume it. FileVault or BitLocker on means a powered-off, encrypted machine is mostly an insurance claim. Off means the disk is readable with a Linux USB stick — treat everything on it as compromised. Check the status for that specific device in your inventory or MDM console; ask the user "did you ever get the 'enable FileVault' prompt?" if no records exist.
• Rotate what the device could hold: SSH keys and GitHub tokens, API keys in .env files and config folders, passwords saved in the browser, VPN configs, chat tokens, any creds pasted into terminal history. This is the same play as an API key leak — enumerate, rotate, verify the old one is dead.
• Check for customer data before anyone says "there was nothing sensitive on it." Cached email attachments, downloads, a spreadsheet of client contacts on the desktop — these count as data on a readable disk, and they can trigger breach notification duties depending on your jurisdiction and contracts. Note what you find, don't guess.
• Watch the account for the next 72 hours: new sign-in alerts, new MFA devices, rules added to the mailbox (a classic post-theft persistence trick), and password-reset attempts on related accounts.

3. The paperwork (do it while the trail is fresh)

• Police report — required by most insurers, and some corporate policies require a report number for breach documentation. Non-emergency line is fine; you want the number, not a manhunt.
• Insurance or lease claim with the serial number (it's in your inventory or the original invoice — this is the moment the asset inventory earns its keep).
• Written incident record: timeline, actions taken with times, encryption status, what was rotated, what you watched. If a customer ever asks "what did you do when the laptop was stolen," this document is the answer.
• If personal data may have been exposed: run it through your incident response plan and check local notification obligations. "Probably fine" is not a defensible conclusion; "we assessed and it was encrypted, here's the record" is.
• Debrief the human. The user who lost the laptop should tell the team what happened and be thanked for reporting fast. Punish the first report and you guarantee the second laptop goes unreported for three days.

4. The mistakes that turn theft into breach

• Waiting to see if it turns up. The most common failure. "It's probably in the car" costs you the revocation window. Lock can be undone; a wiped laptop can be restored from backup; a session that ran for six hours cannot.
• Password reset without session sign-out. Most suites keep existing sessions alive after a password change. Reset + "sign out everywhere" is one action, not two.
• Encryption that was "coming next quarter." If FileVault/BitLocker is not enforced fleet-wide, the first theft is the audit. Enforce it, and store recovery keys centrally — a disk the company cannot unlock is its own mini-disaster.
• Secrets living on laptops at all. Production keys in .env files, browser-stored passwords for admin panels, SSH keys with no passphrase. Secrets belong in the password manager and a rotation cycle, not on a machine that weighs two kilograms and travels.
• No device inventory. You cannot wipe a device you can't identify, and you can't claim insurance on a serial number nobody recorded. Inventory with owner, serial, encryption status, and last-seen date — a spreadsheet beats nothing, MDM beats a spreadsheet.

5. Prevention: make the next theft boring

• Encryption by default — enforced during onboarding via your onboarding checklist, not offered as a settings panel the user never opens.
• MDM or at least remote-wipe enrollment for every laptop that touches company mail. Test the wipe once on a spare device so you know what it actually does (and how long it takes).
• Session hygiene: short idle timeouts on admin consoles, no "remember this device" on the money-path accounts, MFA re-prompt on sensitive actions.
• Backups that make hardware disposable: if the machine is backed up daily, the data loss is zero and the incident is purely about access — which is the incident you can control.
• Add it to the tabletop: one rotation of your tabletop exercise should be "the CFO's laptop just vanished at the airport." You'll find the gaps in revocation in an hour, not during the real one.

Takeaways

• Revoke before paperwork: identity reset + sign-out-everywhere + MFA device revocation + remote wipe + network revocation, in that order, in the first ten minutes.
• Encryption turns theft into insurance; the absence of encryption turns theft into disclosure. Enforce it on day one of device ownership.
• Rotate what the device could hold — tokens, keys, saved passwords — and watch the account for persistence tricks for 72 hours.

---

The Ops Starter Kit ($14) includes the incident record and asset inventory sheets this runbook leans on, and Automation Starter Pack ($19) turns the 72-hour watch (sign-in alerts, new MFA devices, mailbox rules) into an automated daily check. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.