BG Beter Geregeld ICT
Security zonder IT-afdeling · 2 min leestijd · 02 November 2025

Laptop stolen: the first 30 minutes

Someone calls: laptop stolen from the car. The clock is ticking. Here are the 10 steps you MUST take in the first 30 minutes, in order.

Every minute a lost or stolen laptop could be online is a risk. These 10 steps must happen within the first 30 minutes.

\n \n

Minutes 0–10: containment

\n
    \n
  1. Report it to IT / security lead. Record the date and time.
    2. \n
  2. Trigger a remote wipe via Intune / Jamf / Kandji. Now — not later.
    3. \n
  3. Lock the user's account in M365 / Entra. Force sign-out of all sessions.
    4. \n
  4. Revoke MFA tokens — the device is no longer trusted.
    5. \n
  5. Change passwords for the primary accounts used by this user.
    6. \n
\n \n

Minutes 10–20: scope

\n
    \n
  1. What was on it? Check OneDrive sync, local files, vault cache.
    2. \n
  2. Any customer data on board? If yes: this may be a data breach — see data breach notification.
    3. \n
  3. Encryption mitigation: was disk encryption enabled? Usually yes (BitLocker / FileVault) — in that case the physical device is inaccessible.
    4. \n
\n \n

Minutes 20–30: police report and communication

\n
    \n
  1. File a police report for insurance purposes and in case the device is recovered.
    2. \n
  2. Log entry in the incident log. Update later as more information comes to light.
    3. \n
\n \n

Prevention (set up in advance)

\n
    \n
  • Mandatory disk encryption on every device (Intune compliance policy).
    • \n
  • MDM enrolment for remote wipe capability.
    • \n
  • No passwords stored as plain text on the laptop.
    • \n
  • Use a password manager — not the browser's built-in password vault.
    • \n
  • Minimal data on device — work cloud-first with OneDrive.
    • \n
\n \n

See also: security pillar, Intune basics.

Onderwerpen

#security #mdm #incident-response #diefstal

Volledige gids: Seguridad para pymes sin departamento de TI: ¿qué haces este trimestre?

Dit artikel is onderdeel van onze uitgebreide Security zonder IT-afdeling-gids. Lees de pillar voor het complete plaatje.

Lees de pillar →

Verwant leesmateriaal

Security zonder IT-afdeling

Security for SMBs without an IT department: what should you do this quarter?

No IT team, but still accountable. This pillar gives you a priority stack: do this first, then that, then the less urgent stuff. Each item links to a deeper guide.

2 min
Security zonder IT-afdeling

Choosing a password manager for your SMB: what really matters?

Choosing a password manager isn't a matter of taste — but it's not rocket science either. A practical guide for business owners without an IT department.

6 min
Security zonder IT-afdeling

Uptime monitoring for SMBs: don't hear about it from your customers

Your website is down and you find out from a customer. There's a better way. Here's how to set up uptime monitoring as an SMB without an IT department — without drowning in false alerts.

6 min
Security zonder IT-afdeling

Patch management for SMBs without MDM muscle

Patches need to go on. But how do you enforce that without Intune or Jamf? Here's the pragmatic minimum setup.

2 min
Security zonder IT-afdeling

MFA for every SaaS tool, not just M365: catching up the stragglers

M365 and Google make MFA easy. So do Dropbox, Slack, GitHub, and Trello. But those other SaaS tools? MFA is often missing. Here's how to close the gap.

2 min
Security zonder IT-afdeling

Security awareness training: what works and what's a waste of time

An annual 60-minute security video is a waste of time. Quarterly 10-minute targeted sessions actually work. Here's the programme that gets results.

2 min
← Alle artikelen in "Security zonder IT-afdeling"