Endpoint Loss or Theft Response Checklist

When to use this

Use this checklist when a laptop, phone, tablet, or other endpoint device is lost, stolen, or suspected compromised.

Related controls

• A.8.1 User End Point Devices
• A.6.8 Information Security Event Reporting
• A.5.26 Response to Information Security Incidents

Response checklist

• Record device, user, time, location, and circumstances.
• Confirm device ownership and information classification.
• Disable or revoke access tokens/sessions where needed.
• Trigger remote lock/wipe where available.
• Confirm encryption and management status.
• Assess whether personal data or sensitive information may be affected.
• Notify incident/privacy/legal roles where required.
• Record user interview and evidence.
• Update asset inventory and incident record.