Lost or Stolen Work Laptop: A Checklist for the First Hour and the First Day

This is a missing-laptop checklist. It isn't a legal memo, and it isn't a full incident plan.

If a work laptop is gone, treat the accounts signed in on it as reachable until you cut them off. Work this list from a phone or from a computer that isn't the missing one.

It's for an owner or office manager at a business of about 5 to 50 people. If an IT host manages the laptops, call them and read them this page. If their steps differ, follow theirs.

What should a small business do when a work laptop is lost or stolen? In the first hour, report it inside the company, try to lock or wipe it with the tool it was enrolled in, sign the person out of Microsoft 365 and Google, and reset the password and any second-step method that lived on that laptop. Within a day, file a police report if it was stolen, tell the insurer, check whether the drive was encrypted, and ask counsel whether anyone outside the company must be told. This page doesn't decide that last question.

If you also see a ransom note, a bank alert, or a mailbox you can't open, use the first 60 minutes after a cyber incident as well.

The first hour

Write it down and report it

What do I record first? The time, whose laptop, and the last place anyone saw it.

Write the time, the person's name, Windows or Mac if you know it, and the last place it was seen. Leave blanks as unknown. Tell the owner and whoever runs the computers.

CISA's (the Cybersecurity and Infrastructure Security Agency) physical security training says to have a plan for data loss or theft, to list the accounts the device was signed into, and to reset those passwords.

• Time, person, and last location written down
• Owner and IT host told
• You are on a different device

Lock or wipe it, if a tool can reach it

Can I lock a laptop that isn't here? Only if it was enrolled beforehand, and only once it can reach the internet. If it was never enrolled, write not enrolled and go to the accounts.

Windows in Intune

Device actions need the laptop enrolled in Intune and online. Microsoft says IT can wipe or lock a lost or stolen device. On Windows the list includes Wipe, not Remote lock. Remote lock is for Android, iOS, iPadOS, macOS, and visionOS, and only if a passcode is already set.

Open Wipe: Devices > All devices, select the laptop, Remove data > Wipe. Skip keep enrollment state and the user account, because that keeps user data. No options selected factory-resets the PC and deletes user data, and tries to roll back if the wipe is interrupted. Continue to wipe even if the device loses power is the option Microsoft describes for a lost or stolen device. That page warns it can stop some devices from starting again, and says to use it only on corporate-owned devices when you need full destruction and already have a recovery procedure. If you aren't sure, call your IT host before you confirm.

A Mac in Intune has Remote lock. It asks for a six-digit PIN. Write it down. Microsoft says it is shown for up to 30 days, or until the next action, and can't be retrieved after that.

Apple Business

Apple Business Manager is now Apple Business. Locate, lock, and erase works only for supervised devices enrolled in Apple Business's built-in device management (Device Enrollment or Automated Device Enrollment). If the Mac is managed by Intune or another MDM, lock or wipe it there instead. Open Devices > Inventory. Managed Lost Mode locks an iPhone or iPad and can show a phone number. Protect > Lock restarts a Mac to a six-digit PIN you read later in Apple Business. Erase removes all data. Each command waits until the device is online.

Find My

If Find My was already on, open it on another Apple device or at icloud.com/find, select the Mac, and turn on Lost Mode. Apple's lost or stolen Mac page says a Mac with Apple silicon locks with the Apple Account password, and an Intel Mac without a T2 chip can lock with a passcode. The Mac must be on and online. Erase only if you don't expect it back. A remote erase deletes the data, and after that you can't locate it with Find My. User-linked Activation Lock can lock a company-owned Mac to an employee's personal Apple Account. Company-owned Macs should be managed through Apple Business or a device management service.

Microsoft Find my device

Find my device is for a Windows 10 or Windows 11 PC signed in with a Microsoft personal account. Turn it on beforehand. The account must be an administrator. Locating the PC sends a notice to whoever is using it.

Sign in at account.microsoft.com/devices, open Find My Device, select Find, and when it is on the map select Lock > Next. A work or school sign-in is outside what that page covers. Use Intune for those. Microsoft says to report a stolen device to local law enforcement and your insurance company. The serial number is under Info and support.

• Tool named, or not enrolled
• Lock or wipe sent, or skipped
• Any PIN stored off the missing laptop

Sign the person out, and reset what was on the laptop

What do I change if I can't reach the laptop? The password, the saved sign-ins, and any second step that lived on that machine. Use an admin account on a device you still have. The Microsoft 365 admin hygiene checklist is why that admin sign-in should be separate from daily email.

Microsoft 365

MFA (multi-factor authentication) means a password plus a second step, such as an authenticator app or a security key.

In the authentication methods guide, at least an Authentication Administrator opens Entra ID > Users, selects the person, and opens Authentication methods. Reset password assigns a temporary password they must change next sign-in. Give it by phone. Revoke sessions invalidates refresh tokens. Require re-register MFA deactivates hardware OATH tokens and deletes phone numbers, Microsoft Authenticator apps, and software OATH tokens. Use re-register when that second step was on the missing laptop, or when you can't tell. If the authenticator is still on a phone they have, this deletes it too, so help them enroll again on a device they still hold.

Revoke user access says access tokens last one hour by default, and an app that issued its own session token has to end that token itself. Microsoft's emergency steps also include disabling the account. Ask your IT host whether to do that.

Google Workspace

Sign a user out when a device is lost. In the Admin console open Directory > Users, the person, then Security (security settings). Reset the password and require a change at next sign-in. Then Sign-in cookies > Reset. That signs them out across browsers and devices. Gmail can take up to an hour. Resetting cookies doesn't sign them out of apps such as Gmail and Google Drive for desktop, and Google's password reset page says Drive for desktop keeps the old password. Treat Drive for desktop on that laptop as signed in until it is wiped. Remove a security key or passkey created on the lost laptop (Google says remove a key when it is lost) and revoke app passwords from that device. Google says to end any single sign-on session before the cookie reset, because an SSO session can still open the account after the cookies are reset.

• Microsoft 365 password reset and sessions revoked
• MFA re-registered if the second step was on the laptop, or you can't tell
• Google password and cookies reset, if you use Google Workspace
• Lost keys and app passwords removed

Passwords the browser remembered

CISA's physical security training says to reset passwords for accounts the device was signed into, such as email. Change email, bank, payroll, and the line-of-business app, and save them in the company password manager. The rollout checklist is the setup. CISA's Four Cybersecurity Essentials for Businesses says: "A company-wide password manager makes it easier for employees to follow best practices. It generates complex passwords, fills them in and stores them securely."

• Those passwords changed and stored in the company vault

Within 24 hours

Police report

When do I call the police? When the laptop was stolen.

Apple says to report a lost or stolen Mac to local law enforcement, and that they might ask for the serial number. Microsoft's Find my device page says to report a stolen device to local law enforcement. The serial number is under Info and support.

If personal information may have been exposed, the FTC's (Federal Trade Commission) Data Breach Response: A Guide for Business says to call your local police department immediately and report the situation and the potential risk for identity theft. Write down the report number. If local police aren't familiar with this, the guide says to contact the local FBI or U.S. Secret Service office.

• Report number written down, or not filed, and why

Insurer

Microsoft recommends reporting a stolen device to your insurance company. Call the number on the policy that covers the laptop or the business. This page doesn't describe coverage, and it doesn't tell you to file a claim.

• Insurer called, or no policy

Was the drive encrypted?

How do I know if the files are readable? Check a record. Leave it unknown if nobody can show you one. The FTC guide says to find out whether measures such as encryption were enabled. Bring that answer to counsel.

Windows. BitLocker encrypts whole volumes on a lost or stolen device. Where the PC supports it, Device encryption turns on at first sign-in with a Microsoft, work, or school account, and attaches the recovery key to that account. A local account leaves it off. Ask whether a recovery key was saved.

Mac. FileVault is required to encrypt a Mac that lacks Apple silicon or a T2 chip. On a Mac that has one of those, the data is already encrypted, and FileVault is what requires the login password. Count it as protected only if FileVault was on. Management can require it in Setup Assistant on macOS 14 or later and hold the recovery key. Ask whoever enrolled the Mac.

• BitLocker or FileVault: on / off / unknown, and where the key is stored

Whether anyone outside the company must be told

Do we have to notify customers? Talk to counsel. This page doesn't decide.

The FTC guide says to talk to legal counsel, who can advise on federal and state laws that may be implicated by a breach, and to determine your legal requirements. Bring what was on the laptop, whether the accounts were signed out, whether encryption was on, and the police report number. Follow counsel. A customer notice doesn't come from this checklist.

• Counsel asked, or the question is on tomorrow morning's list

Before the next laptop leaves the office

Encryption on, and confirmed

CISA's Cyber Guidance for Small Businesses says to enable disk encryption for laptops, and that Windows and Mac laptops must be configured to encrypt their drives. Use the checks above while the laptop is still in the office, and keep the recovery key out of the laptop bag.

Enroll it while you still have it

Intune can wipe or lock only an enrolled device, and only when it is online. Apple Business can locate, lock, or erase only a device enrolled in its built-in device management. Find My and Find my device have to be on before the laptop goes missing.

Password manager

Saved browser passwords become a reset list. CISA's physical security training says the master password belongs in a safe or similar security system with access controls. The rollout checklist puts a team this size on one vault.

A one-page inventory

Keep a line per laptop so you can name the serial number and the console. Apple says law enforcement might ask for the serial number. Microsoft shows it under Info and support for a personal Microsoft account.

Leave blanks as unknown. Update the row when a laptop is issued, and when someone leaves.

Printable log

Date: YYYY-MM-DD · Filled by: · Laptop:

Save it as lost-laptop-YYYY-MM-DD.

Related guides

• Password manager rollout checklist: move saved passwords into a company vault
• Microsoft 365 admin hygiene: keep an admin account you can still sign in to
• First 60 minutes after a cyber incident: if the missing laptop is part of a wider incident
• Resources: CISA and NIST references

Educational content only — not legal, insurance, or compliance advice.