Critical Security Incident: Stolen Device Intake & Response Protocol

Employee Full Legal Name

Employee Unique Identifier

Employee Department/Division

Employee Job Role Title

Employee Primary Contact Number

Employee Alternative Contact Number

Employee Corporate Email Address

Employee Personal Email Address (for recovery coordination)

Employee Work Arrangement at Time of Incident

Provide detailed travel itinerary: cities, hotels, transportation modes

Customer/Client Organization Name

Co-working Space Name and Address

Describe public location context: venue name, address, time spent

Compromised Asset Inventory

Exact Date and Time Theft Discovered (Employee Local Time)

Employee Time Zone at Discovery

Last Confirmed Physical Possession (Date/Time)

Theft Location Physical Address or GPS Coordinates

Is the theft location the employee's designated remote work address?

Detailed Description of Location Environment

Was the device connected to corporate VPN at time of theft or last known session?

Last Known VPN IP Address

Explain network connectivity status and last known corporate network access

Was the device domain-joined or Azure AD joined?

Domain Name or Azure AD Tenant ID

Has a formal police report been filed with local law enforcement?

Police Report/Crime Reference Number

Explain why police report was not filed and planned next steps

Law Enforcement Agency Name

Precinct/Station Address

Investigating Officer Name and Badge Number

Officer Contact Information (Email/Phone)

Date and Time Police Report Filed

Upload Official Police Report Document (PDF/Scan)

Upload Photo of Police Report Receipt or Acknowledgment

Theft Incident Classification

Was the vehicle corporate-owned or personal?

Describe the 'Other' classification in detail

Estimated Date and Time of Theft (if different from discovery)

Employee Activity at Time of Incident (select all applicable)

Were there any witnesses to the theft or suspicious activity?

Witness Details: Name, Contact, Statement Summary

Was CCTV or surveillance footage available at the location?

CCTV Details: Camera locations, retention period, contact for footage retrieval

Was the device stored in a locked container (safe, lockbox, trunk) when stolen?

Describe container type and locking mechanism

Explain why device was not secured in locked container

Assess the physical security of the theft location environment

Detailed Narrative of Events Leading to Loss

Was any other corporate or personal property stolen simultaneously?

Has a remote wipe command been initiated via Mobile Device Management (MDM)?

MDM Remote Wipe Status

Command Initiation Timestamp

Command Sent Timestamp

Wipe Confirmation Timestamp

Error Details and Failure Reason

Explain why MDM wipe was not initiated and alternative mitigation steps

Was the device enrolled in Microsoft Intune, Jamf Pro, or other MDM platform?

MDM Platform Name and Version

Was the device configured with 'Find My Device' (Apple) or 'Find My Device' (Android/Windows)?

Provide tracking status and last known location if available

Digital Access Revocation Checklist

Have all active directory sessions been terminated across all domain controllers?

Were any privileged/administrative credentials cached or stored on the device?

List all privileged accounts and immediate containment actions taken

Was a remote lock command sent to prevent device boot or access?

Lock Command Reference ID

Has the device been flagged in asset management system as 'Stolen - Security Incident'?

Has the SIM card (if applicable) been deactivated with mobile carrier?

Carrier Name and Deactivation Reference

Additional Digital Containment Measures Implemented

Official Corporate Data Classification Level of Device

Describe specific confidential data categories present

Describe specific restricted data categories present

Describe specific top secret data categories present

Was the device protected with Full Disk Encryption (FDE) at time of theft?

Encryption Standard and Algorithm

Justification for lack of encryption and immediate risk mitigation

Was the device powered on or in sleep/hibernation mode when stolen?

Was the user logged in and session unlocked?

Describe session state and potential data exposure risk

Select all categories of sensitive data potentially stored on or accessible via the device

Did the device have offline/local copies of cloud-synced files?

Which cloud storage services had offline copies?

Were any cached credentials stored on the device?

Was the device configured with auto-save or recent documents cache?

Describe applications with auto-save and potential data remnants

Last Successful Cloud Backup or Sync Timestamp

Was any data actively being transferred or synced at time of theft?

Describe data transfer context and potential interception risk

Rate the potential exposure severity for each data category (1=Minimal, 5=Catastrophic)

Does this incident potentially trigger regulatory breach notification requirements?

Select potentially applicable regulatory frameworks

Estimated Volume of Sensitive Records Potentially Compromised

Has a preliminary data inventory been conducted from backup logs?

Upload Data Inventory Analysis Report

ISO Security Controls Validation

Does the ISO recommend escalation to executive leadership or legal counsel?

Escalation Rationale and Recommended Actions

IT Service Desk Operational Verification

Has the employee been provided with security awareness retraining?

Training Module Completed and Date

Schedule and plan for mandatory security retraining

Has a replacement device been provisioned to the employee?

Replacement Device Asset Tag

Explain delay and estimated provisioning timeline

Information Security Officer Digital Signature

Information Security Officer Name (Printed)

Information Security Officer Title

Information Security Officer Sign-off Timestamp

IT Service Desk Lead Digital Signature

IT Service Desk Lead Name (Printed)

IT Service Desk Lead Title

IT Service Desk Lead Sign-off Timestamp

Do both authorizing officers approve incident closure?

Final Incident Summary and Lessons Learned Recommendations

Should this incident be included in quarterly security metrics and board reporting?