What to Do When an Employee Loses a Device

Time information: This article was automatically generated on October 21, 2026 at 6:52 AM (Asia/Jakarta, 2026-10-20T23:52:15.760Z).

What should happen first after a device is lost?

When an employee loses a laptop, phone, or tablet, the first hour matters. The goal is not to panic; it is to reduce the chance that company systems, customer data, or authentication tokens can be used by someone else.

Start with a simple rule: treat every lost work device as a potential security incident until you know otherwise. For a SaaS company in Indonesia, especially one with remote-first staff, that means the response should begin immediately, even if the device was “only” used for email or chat.

Your first actions should be:

• Confirm the device is actually missing and not just misplaced.
• Ask when it was last seen and what was being accessed.
• Disable active sessions, revoke tokens, and reset credentials if necessary.
• Use MDM or endpoint tools to lock, locate, or wipe the device if your policy allows it.
• Record the incident in a shared log with time, owner, and actions taken.

If the device was used for admin access, customer support, finance, or code repositories, escalate faster. In many SaaS environments, a lost device is not just an asset issue; it can become an access-control incident.

Why device loss is a compliance issue, not just an IT issue

For Indonesian SaaS teams, device loss can trigger questions across security, privacy, legal, and operations. A laptop may contain cached emails, chat history, source code, customer records, or access to cloud dashboards. Even if the data is encrypted, the organization still needs to show that it has a controlled response process.

This is where compliance comes in. Frameworks such as ISO 27001 do not require perfection, but they do expect disciplined risk management, documented controls, and evidence that incidents are handled consistently. If your company works with enterprise customers, procurement teams will often ask how you manage endpoint risk, remote access, and incident escalation.

In practice, the compliance question is simple: can you demonstrate that the device was protected, the incident was assessed, and the response was appropriate?

For startups and enterprises in Jakarta and across Indonesia, that answer becomes much easier when the process is written down before anything goes wrong.

How do you assess the risk?

Not every lost device creates the same exposure. A careful assessment should consider both the device and the data on it.

Ask these questions:

• Was the device encrypted with full-disk encryption?
• Was the user signed in with MFA-protected accounts?
• Were sensitive files stored locally?
• Did the device have access to production systems, admin panels, or customer data?
• Were browser sessions, password managers, or API keys available?
• Was remote wipe enabled and successful?

The result of this review should be a documented risk rating: low, medium, or high. A low-risk incident might involve a fully encrypted device with no local sensitive data and fast credential revocation. A high-risk incident might involve an unencrypted laptop with privileged access and stored customer information.

Do not assume that “no one can unlock the device” is enough. If the device had active sessions or stored tokens, the attacker may not need the password at all.

What controls should be in place before a device goes missing?

The best response starts long before the incident. Indonesian SaaS companies should build a baseline of controls for all employee devices, especially for remote-first teams.

Key controls include:

• Full-disk encryption on laptops and mobile devices
• MFA for email, cloud apps, and source control
• MDM or endpoint management for lock, wipe, and policy enforcement
• Least-privilege access for production and customer systems
• Password managers with strong master authentication
• Device inventory with assigned owners and serial numbers
• Automatic screen lock and short idle timeout
• Separation of work data from personal storage and apps

These controls are especially important when employees travel between Jakarta, other Indonesian cities, or overseas. A device loss during transit, at a coworking space, or in a ride-hailing trip is still a security event if the device can be used to access company systems.

What is the right incident response workflow?

A good workflow should be short, repeatable, and owned by specific people. For example:

1. Employee reports the loss immediately to IT or security.
2. IT verifies the device, last known location, and access level.
3. Security or engineering disables sessions and resets credentials if needed.
4. The device is locked or wiped through management tools.
5. The incident owner performs a risk assessment.
6. Legal, compliance, or customer-facing teams review notification obligations.
7. The team documents lessons learned and closes the incident.

This workflow should be tested. A tabletop exercise is often enough to reveal weak spots, such as unclear ownership, missing device inventory, or delays in revoking access. For funded startups, a short drill can be more valuable than a long policy document nobody uses.

Should you notify customers, regulators, or auditors?

Sometimes yes, but not automatically. Notification depends on the facts, the data involved, contractual commitments, and applicable legal or regulatory requirements. In Indonesia, companies should review obligations carefully and seek professional advice where needed.

A practical rule is this: if the lost device may have exposed customer data, credentials, or regulated information, involve legal and compliance early. Do not wait until the investigation is complete before deciding who needs to know.

For audit readiness, keep evidence of:

• the incident timeline
• the affected user and device
• actions taken to contain the incident
• the risk assessment and rationale
• any notifications made or considered
• follow-up remediation steps

This documentation matters for ISO-related audits, customer security reviews, and internal governance. It shows that the organization did not improvise under pressure.

Key takeaways

• Treat every lost work device as a potential security incident until proven otherwise.
• Containment comes first: disable access, revoke tokens, and use remote lock or wipe if available.
• Encryption, MFA, and MDM significantly reduce the impact of device loss.
• A documented risk assessment is essential for compliance and audit readiness.
• Customer, legal, and regulatory notifications should be reviewed case by case, not assumed.

How can APLINDO help teams prepare?

APLINDO works with funded startups and enterprises to design practical security and compliance processes that fit real operations. From our Jakarta HQ and remote-first delivery model, we help teams build incident response playbooks, strengthen endpoint controls, and align engineering practices with compliance goals.

If your organization needs support, APLINDO can assist with SaaS engineering, applied AI, Fractional CTO guidance, and ISO/compliance consulting. For teams that want to operationalize controls, products like Patuh.ai can support multi-ISO compliance workflows, while SealRoute can help with secure document signing processes.

The main point is simple: device loss is inevitable, but weak response is optional. With the right controls and a clear playbook, Indonesian SaaS companies can respond quickly, reduce exposure, and stay ready for audits, customers, and growth.