Lost device response plan: the first hour decides, not the lock screen

A lost device is a keyring walking; the response that matters happens in the first hour, from another machine.

A lost phone or a stolen laptop is not primarily a hardware loss. The device is a keyring, and what walked out the door is a signed-in mailbox, a chat history, a set of tokens that open the company's accounts without ever showing a password. That is why the response that matters happens in the first hour, before anyone could even try the lock screen. Replacing the hardware is an errand; closing the doors the device holds open is the work.

The first hour has a shape, and it can be rehearsed. Mark the device lost from the vendor's tracking, so the machine announces itself as missing. Revoke its mail sessions, which signs the inbox out remotely and ends the connection the thief never had to break. Rotate the password of the account the device was logged into, so anything copied yesterday stops working today. And check the sign-in history, to see whether anyone got there first, because the hour you spend assuming is the hour someone else spends entering.

The order matters as much as the actions. Revoking sessions before rotating the password leaves nothing half-open, and checking the history after rotating tells you whether the race was close. None of these steps requires the device itself, which is the entire point: every meaningful move happens from another machine, in the account's own settings, by someone who knows which switches to reach for.

This is why the plan exists before the loss. Nobody invents that sequence calmly on a sidewalk; the hand that lost the device is shaking, and the company's questions arrive all at once. The two parts that cannot be done later are done today: a recovery contact set on the accounts, so a locked-out owner has a path back in, and a device list kept current, so the first question is answered before it is asked. Everything else can be reconstructed; these two cannot.

The company's part is narrow and worth naming: the list, the session revocation, and the rehearsed order. One page, kept where the team can find it without the person who wrote it. Who calls whom, which accounts are touched first, where the sign-in history lives, and who owns the decision to revoke. A fifteen-minute walkthrough twice a year turns a panic into a procedure, so the first real loss is not the first time anyone has read the plan.

The honest limit is that the deep mechanics belong elsewhere. How the device's encryption behaves, how far a remote wipe reaches, and what the police or an insurer will need differ by device and by jurisdiction, and those specifics belong to the vendor's documentation and, where the stakes are real, to counsel. What the company owns is the response at the account level: the list, the revocation, and the order.

A lost device tests whether a company knows what it is holding. The hardware was never the asset; the access was, and access responds to the account's own switches. Guidance, not guarantees: build the list, set the recovery contact, rehearse the first hour, and the worst day starts with a procedure instead of a guess.