When you are deciding what to do when a business laptop is lost or stolen, start by protecting access to business accounts, not by waiting to see whether the device turns up. A laptop may contain local files, saved passwords, active browser sessions, or access to cloud services. The right response depends on what was stored on it and how it was protected, so act promptly while recording what you know.
These lost company laptop security steps are a practical starting point for a small business. If you have an incident response plan or an IT provider, follow its instructions and involve them early.
Start with these immediate actions
- Report the loss and make a record. The employee should tell their manager and IT or security contact as soon as possible. Record when the laptop was last seen, where it may have gone missing, whether it may have been stolen, and whether it was powered on or in use. Do not delay account protection while trying to recover the device.
- Identify the laptop and its access. Note the assigned employee, device name or asset ID, operating system, and any management or security tools installed. List the work accounts and services the laptop could reach, including email, cloud storage, remote access, business applications, and password managers.
- Revoke access from the lost laptop. Ask your administrator or IT provider to sign the device out of business identity and application services, revoke active sessions or tokens where available, and disable the device’s access if the management tools support it. A password change alone may not end existing sessions. Microsoft documents how administrators can revoke user access in an emergency in Microsoft Entra ID.
- Secure the employee’s credentials. From a trusted device, reset the employee’s business password and review or reset recovery methods and multifactor authentication settings if needed. Check whether the missing laptop had access to administrator accounts, shared credentials, or a password manager. Do not send new passwords to the missing device or reuse the old password.
If you need a broader playbook for coordinating people, decisions, and communications during a security event, review your incident response plan.
Which accounts should you secure first?
Prioritize accounts according to how much damage someone could cause through them. Begin with identity and administrator accounts that can reset other passwords, add users, or change security settings. Then protect email and cloud storage, since they may expose business messages and files and may be used to access other services.
Next, address remote access and the business applications available from the laptop. Include systems that hold sensitive customer, employee, financial, or operational information. If the employee used the device to access payment or financial services, secure those accounts as well. Ask your provider to check the access records for unusual activity rather than assuming a password reset has resolved everything.
Consider saved browser passwords, browser sessions, password-manager access, and any authentication tokens or certificates the device may have held. A saved password is not the only concern: a browser may have remained signed in to services. Review the relevant account and application controls for separate options to sign out sessions, revoke tokens, or remove the device.
Use remote lock or wipe if available, but do not rely on it
If the laptop is enrolled in device management or has an endpoint security tool, ask the administrator to check whether it can be remotely locked, located, or erased. The available actions depend on the device and its setup. A remote wipe may not reach a laptop that is offline or disconnected, so it should not replace revoking access or reviewing what data the device could reach.
Make the decision with your IT provider where possible. Erasing a device can remove information that may be useful for an investigation or recovery, and the appropriate choice depends on the circumstances. If the device is connected to a personal account or uses a platform’s built-in recovery feature, consult the provider’s instructions. For example, Google explains its available options to lock or erase a lost phone or computer.
Work out what information may be exposed
Separate information stored on the laptop from information it could access online. Local exposure may include downloaded files, saved email attachments, cached work data, and files in folders that synchronize with cloud storage. Account exposure may include cloud documents, email, business apps, or shared systems that were accessible through an active session.
Ask whether the laptop was encrypted, whether it was locked with a strong sign-in method, and whether anyone knows it was accessed after it went missing. Confirm encryption status through the device management or security tools when possible. Do not assume a device was encrypted simply because encryption is available on that type of laptop. Also ask whether sensitive files were stored locally or only accessed through managed cloud services.
These details help your team assess the potential exposure; they do not, on their own, determine whether information was accessed. Review available sign-in, endpoint, email, and application activity with your IT or security provider. For ways to reduce sensitive data stored or exposed across your environment, see these small-business data protection practices.
When to escalate and what to hand off
Treat the missing device as a security incident while you establish the facts. Escalate promptly if it may contain sensitive business or personal information, if it was unlocked or unencrypted, if the loss may involve theft, or if you see unfamiliar account activity. Even when the laptop appears to have been protected, document the assessment and the actions taken.
Whether notifications are required depends on the information involved and applicable state, federal, industry, or contractual requirements. If sensitive information may have been exposed, involve qualified counsel or the appropriate regulator to understand what applies. Avoid making a notification decision based only on whether the laptop has been recovered.
Give your IT provider or incident lead a concise handoff covering:
- The employee and device name or asset ID.
- When and where the laptop was last seen, and whether theft is suspected.
- Whether it was powered on, locked, and believed to be encrypted.
- Accounts and services it could access, including administrator access.
- Types of information stored locally or available through connected services.
- Actions already completed, such as password resets, session revocation, or a remote lock request.
- Any alerts or unusual activity found during the review.
If you are supporting a team that works away from the office, a written process for reporting missing equipment and restricting access can help people respond consistently. See this guide to cybersecurity for remote small-business teams.
Frequently asked questions
Should we change the employee’s password or revoke active sessions?
Do both when the accounts and tools allow it. A password reset helps protect future sign-ins, while revoking sessions or tokens can address access that may already be active. Also review device access and individual applications rather than assuming one action covers everything.
What data might be exposed if a laptop is lost?
Potentially exposed information includes local files and downloads, email attachments, cached data, saved credentials, browser sessions, and business services the device could access. The actual exposure depends on how the laptop was configured and what information was available to it.
Can we remotely wipe a laptop that is offline?
A wipe command may not reach a device that is offline or disconnected. Use available device-management controls, but continue revoking account access and assessing the information that may be stored on or accessible from the laptop.
When should we treat a missing laptop as a data breach?
Start by treating it as a security incident and investigate what data was involved, whether it was protected, and whether there is evidence of access. Whether it meets a breach definition or triggers notification obligations depends on the circumstances and applicable requirements, so seek qualified guidance when sensitive information may be involved.
Protect access first, then make the next decision
A calm, documented response helps your team avoid overlooking active sessions, locally stored files, or connected accounts. If you need help coordinating protection and incident response, Zevonix provides fully managed, right-sized cybersecurity for small businesses, with 24/7 threat monitoring included with every plan. Contact Zevonix at (904) 658-0777 to discuss your security needs.