SOP Linked: HERE
Last Updated: April 2024
Process Owner: Casey Egan
Handling a Lost or Stolen Laptop
Purpose
To establish a standardized procedure for responding to incidents involving lost or stolen company laptops to protect sensitive information and minimize security risks.
Scope
This SOP applies to all employees, contractors, and affiliates who use company-issued laptops.
Responsibilities
Employees are responsible for immediately reporting lost or stolen laptops.
IT Department is responsible for responding to reports of lost or stolen laptops, including taking immediate security measures, tracking, and recovery efforts.
Security Team is responsible for investigating the incident and coordinating with law enforcement if necessary.
HR Department is involved in communicating policies and potential disciplinary actions related to the loss or theft.
Procedure
Immediate Notification
Upon discovery of a stolen laptop, immediately notify the appropriate authorities within the organization, such as IT security personnel, the IT helpdesk (#it-support), Human Resources (#hr-connect) and management.
Documentation of Incident
Document all available information regarding the incident, including the date, time, and location of the theft, serial number of the stolen laptop, and any identifying marks or features.
Report to Law Enforcement
Report the theft of the laptop to the local law enforcement authorities as soon as possible, providing them with all relevant details and documentation. Provide the case number to management once produced.
Remote Lock and Wipe
If the stolen laptop is equipped with remote management or tracking software (e.g., Find My Mac), initiate remote locking and data wiping procedures to protect sensitive information stored on the device.
Ensure that the remote lock and wipe procedures are carried out in accordance with the organization's security policies and procedures.
Change Credentials
Instruct the user(s) of the stolen laptop to change any passwords or credentials associated with their accounts, including but not limited to Apple ID, LastPass, email accounts, team email alias accounts, Shopify and any other accounts hosting sensitive data.
Emphasize the importance of using strong, unique passwords for each account and enabling two-factor authentication where available. See Access Control Policy
Inventory and Asset Management
Flag to HR in order for them to update the organization's inventory and asset management records to reflect the status of the stolen laptop to DC Computers.
HR will request a replacement laptop to be sent to the employee’s address on file via Fedex overnight delivery.
Review Security Measures
The IT security team will conduct a thorough review of existing security measures and protocols to identify any weaknesses or gaps that may have contributed to the theft of the laptop. As an employee, your role is to provide any relevant information or observations regarding security measures you've encountered in your day-to-day activities. This could include issues with access control systems, concerns about physical security measures, or any instances where security protocols were not followed. After the review, the IT security team may implement additional security measures or enhancements based on their findings. As an employee, you should remain vigilant for any new security protocols or procedures communicated by the IT department and adhere to them accordingly.
IT / Security Department Actions Based on Findings:
Document Changes: Make any changes necessary to security protocols and communicate to all employees via email or through company-wide meetings. It's essential to review these communications carefully and familiarize yourself with any updated security measures to ensure compliance.
Training and Awareness: Provide additional training sessions to educate employee on the importance of security measures and how to recognize and respond to potential security threats.
Follow-Up and Monitoring
Follow up with law enforcement authorities and provide any additional assistance or information they may require during their investigation. Monitor any developments related to the stolen laptop, such as potential sightings or recovery efforts, and provide updates to the IT security team.