The First Hour After a Laptop Goes Missing
The useful hour is the one before the device joins a new network. Spend it on actions, not on a committee.
People lose laptops in ordinary ways: a rideshare, a clinic break room, a backpack at a gate. The security question is whether your organization can do three things before that laptop is opened by someone else.
Hour one
- Name the device. Serial, assigned user, and whether disk encryption was on. If you cannot name it, you cannot wipe the right machine.
- Lock or wipe. If the laptop might be recovered quickly and you know it is encrypted, lock may be enough. If it held data you cannot re-collect, wipe. Write that rule down before the incident, not during it.
- Reset the accounts that laptop could open: mail, VPN, file shares, and any admin console.
- Tell the person who owns the privacy clock. A lost device with personal data is an incident even when the headline breach that month is someone else's.
DriveStrike is built for the lock, wipe, and locate steps. From the device page you can request a locate, lock a supported device, and wipe enrolled drives, including secondary drives attached to that computer. Read what the product is for before you assume it covers a phone your company never enrolled.
What not to do
Do not wait for a police report to start the wipe. Do not announce a wipe in a group chat and then discover nobody has the right admin role. Do not tell the employee "IT will handle it" if IT has no agent on that laptop. The first hour is a process test. Run it on a spare machine this month, then keep the inventory honest.
Start a DriveStrike trial if you want that test to be real, or contact Spearstone to walk through the decision tree.
Keep reading
- PowerSchool's SIS Incident Meets the Laptop in a Student's Backpack
- M&S Told Customers Personal Data Was Taken. Passwords Were Not.
Questions worth answering directly
Should every missing laptop be wiped?
Not always. A locked, encrypted laptop that is likely to be returned can be locked first. A laptop with sensitive data and no credible path home should be wiped. Decide the rule in advance.
Is remote wipe the whole response?
No. Reset credentials, preserve the report, and follow your privacy notice process. Wipe addresses the copy still stored on the device.