The lost device first hour
A client's sales director calls at eight in the evening. Her laptop is on a train heading north, along with, she thinks, a printed customer proposal. The engineer who picks up has no written process, so he does what he did last time, which isn't what his colleague did the time before.
Lost devices are routine, which is why they get handled inconsistently. One engineer wipes immediately, another waits a day, and nobody records whether the disk was encrypted or which accounts were signed in. If it later needs reporting, nobody has the facts.
Gather first: your device management capabilities and each client's encryption coverage.
The prompt:
Build a lost or stolen device procedure for our clients, so every engineer handles the first hour the same way.
What experienced engineers know:
Lost devices are routine, which is why they get handled inconsistently. One engineer wipes straight away, another waits a day, and nobody records the facts.
The questions that matter later are whether the disk was encrypted, which accounts were signed in and what was revoked when. If it needs reporting, those facts are the report.
Wiping too early destroys the chance to locate the device. Waiting too long leaves sessions open.
Our device management tools: [lock, wipe, locate capabilities]
Encryption coverage across client devices: [details]
Client reporting obligations, such as healthcare, legal or data protection: [details]
Do this:
Write a first-hour checklist covering lock, locate, session revocation, password resets and the decision rule for wiping.
Create a short incident record with timestamps for each action.
Draft a message to the client confirming what was done, whether the device was encrypted, and whether the loss needs reporting under their obligations.
Where the reporting decision depends on facts we do not have, list the questions to answer before deciding.