Stolen Laptop? Here's Your Incident Response Checklist

1 Report & Assess

• Notify your internal IT or security team. If you don't have internal IT, call your managed IT provider immediately. Cloud Collective clients call 1-888-316-1883 and select the emergency option.
• Notify your cybersecurity insurance provider (e.g., Coalition). Most policies require notification within 24–72 hours to maintain coverage. Ask about incident response resources — many insurers provide free forensics and legal support.
• Report to local police and obtain a report number. You'll need this for insurance claims and potential regulatory notifications. File the report even if you think recovery is unlikely — it creates a paper trail.

Determine what was on the laptop:

• Identify if client files, PII, or sensitive data were stored locally.
• Confirm whether the laptop was encrypted (BitLocker, FileVault, etc.).
• Check if endpoint protection (antivirus, MDR) was installed and active.
• List cloud drives, VPN connections, and open systems the laptop had access to.
• Check for saved passwords in browsers, password managers, or SSH keys.

↻ Revoke Access — Do This Now

• Disable the user's account in Microsoft 365 (or Google Workspace).
• Revoke active sessions and tokens in the identity provider.
• Disable access to document management systems (NetDocuments, iManage, etc.).
• Reset the user's password manager vault and force re-enrollment of MFA.
• Revoke any VPN certificates or network access tokens.
• Check for and revoke any OAuth app tokens the device may have cached.

Attempt remote wipe or lockdown:

• Use Microsoft Intune, Jamf, or your MDM to issue a remote wipe command.
• If MDM isn't available, use endpoint protection software (SentinelOne, CrowdStrike, etc.) to freeze the device.
• If neither is available, the access revocation above is your primary defense — encryption is what actually protects the data at rest.

2 Assess & Contain

Log everything. From the moment the incident is reported, maintain a secure incident response log with timestamps, actions taken, and who took them. This is your evidence if regulators, insurers, or clients ask what happened.

• Notify internal stakeholders — department heads, managing partner, legal counsel, IT, compliance officer.
• Assess data exposure risk based on what was on the laptop and whether encryption was active.
• Scan login and usage logs for unusual activity from the stolen device's IP, MAC address, or session tokens.
• Check Microsoft 365 sign-in logs for attempts from new locations.
• Check VPN logs for connection attempts.
• Review document management system and cloud application audit trails.
• Document whether saved passwords or cached credentials were present on the device.

3 Notify & Report

Consult legal counsel to determine your notification and reporting obligations. This is not optional — the legal landscape around breach notification is complex and varies by jurisdiction, industry, and the type of data involved.

• Determine whether this constitutes a "real risk of significant harm" under PIPA/PIPEDA. If the laptop was encrypted and no credentials were stored, the risk may be low enough that notification isn't required. If the laptop was unencrypted or had saved passwords, assume notification is required.
• Notify affected clients (if required) with approved messaging. Legal counsel should review the notification language before sending. Be honest about what happened, what data was at risk, and what you've done to contain it.
• Report to regulators if required:
  • Office of the Information and Privacy Commissioner for BC (OIPC) — if PIPA applies.
  • Office of the Privacy Commissioner of Canada (OPC) — if PIPEDA applies.
  • Law Society of BC — if client trust records or privileged data were at risk (Rule 10-4).
  • Other industry regulators as applicable (College of Physicians, FINTRAC, etc.).

4 Recover & Remediate

Reset all credentials that may have been accessible from the stolen device. Don't take chances — reset everything, even if you think it wasn't cached.

• Microsoft 365 / Google Workspace password — force reset.
• Email account password and app passwords.
• Password manager master password and re-enroll MFA.
• VPN credentials and client certificates.
• Document management system credentials.
• Any line-of-business application passwords (accounting, practice management, CRM, etc.).
• Browser-saved passwords — clear and reset all.
• SSH keys or service account credentials stored on the device.
• WiFi network credentials if the device had them saved.

Issue replacement hardware and configure it properly before handing it over:

• Enroll in MDM (Intune, Jamf) before the user gets the device.
• Enforce full-disk encryption from day one.
• Deploy endpoint protection (antivirus/MDR).
• Configure conditional access policies (no unencrypted device gets in).

Monitor systems for any unusual or unauthorized activity for at least 30 days. Update asset inventory — mark the stolen device as compromised and review conditional access policies.

5 Review & Improve

Once the immediate crisis is over, the real work begins. A stolen laptop is a stress test of your security posture — use it to find and fix the gaps.

• Conduct an internal debrief with all stakeholders who were involved in the response.
• Document lessons learned — what went well, what was slow, what broke down.
• Train staff on security and data handling procedures. Remind everyone: report lost or stolen devices immediately, not "after I check a few things." Reinforce that local storage of sensitive files should be the exception, not the norm.
• Update your incident response plan based on what you learned.
• Review insurance coverage — are you adequately insured for cyber incidents?
• Audit all company laptops — is encryption actually enforced on every device?