Lost or Stolen Device Response

A missing device is both an access problem — live sessions, tokens, saved credentials — and a
data problem. Move fast on the reversible steps and gate the
irreversible ones behind explicit approval. The client's admin or MDM owner executes every
lock, wipe and MDM action; you drive and document.

1. Capture the facts: which device, whose, when and where last seen, lost or confirmed
   stolen, whether it was encrypted (BitLocker/FileVault), whether it had a passcode or
   biometric lock, and what it could reach — mailbox, VPN, saved passwords, local files, MFA
   authenticator app.
2. Take the reversible steps now, without waiting on the wipe decision: revoke the user's
   active sessions and refresh tokens (a device holds live sessions that survive a password
   reset — see session-token-theft-response), rotate the account password, and if the device
   carried an MFA authenticator, re-enroll MFA on a trusted device and remove the lost method.
3. Assess data exposure honestly: encrypted at rest plus a strong lock is low practical data
   risk; unencrypted or unlocked means assume the contents are readable. Note regulated data
   (PHI, cardholder, PII) that may have been on it — notification obligations are a client
   and management call, never yours.
4. Remote-lock or mark-as-lost early where the platform supports it: reversible, buys time,
   and can display a return message without destroying anything.
5. Gate the remote WIPE on explicit approval. A wipe is destructive, and on a merely
   misplaced device it may be premature or may destroy a personal-data BYOD boundary. Lay out
   the trade-off — data-exposure risk against loss of the device's data and its recovery
   chance — and get an explicit yes before any wipe is issued.
6. Direct the external steps; you do not perform them. The user or client reports theft to
   police and gets a report number (usually required for insurance), and contacts the mobile
   carrier to suspend or blocklist a stolen phone by IMEI. Record the case numbers.
7. If this is a departing employee, coordinate with employee-offboarding for access
   revocation and asset recovery, and watch insider-risk-basics if the loss
   looks convenient.
8. Document the decision, not just the action: device details, encryption and lock state, the
   exposure assessment, every protective step with a timestamp, the wipe decision and who
   approved it, and the external steps directed. Classify per soc-classification-tree.

Never issue a remote wipe without explicit client approval — a wiped but recoverable device,
or a wiped personal BYOD partition, is an irreversible loss. Lock first, wipe on approval.
Client-facing wording follows the defensive-writing-standard skill — "a device is unaccounted
for and access from it has been revoked", not "your data was stolen" unless the evidence
shows it.