If a work device is lost or stolen, notify the designated workplace contact promptly and provide an accurate account of its last known custody. The response may involve device management, account access, information assessment and other actions that belong to authorised responders.
Do not delay reporting while trying to retrieve the device or work out every possible consequence. Keep personal safety and the organisation’s actual incident process in view.
Record what is known
Identify the device using the approved asset reference and describe when and where it was last seen. State whether the circumstances suggest loss or theft without presenting an assumption as a confirmed fact.
Australian cyber-security guidance on protecting devices, systems and networks provides context for device protection and recovery measures. Follow the actual workplace response arrangement for the device and information involved.
If there is an immediate danger or a separate emergency, use the appropriate emergency process. Do not confront someone or visit an unsafe location to recover equipment yourself.
Use a initial-report checklist
Provide through the approved channel:
- Asset: relevant device identifier and type.
- Custody: last known time, location and authorised user.
- Circumstances: factual account of the loss and information still uncertain.
- Access: relevant sign-in or device-protection information requested by the responder, without sharing secrets.
- Data: categories of work information potentially involved, as known.
- Actions: any steps already taken and by whose authority.
- Contact: reliable way for the response team to reach you.
- References: any approved property or incident report details.
Keep the information restricted to the response process. A broad team email should not list account details or sensitive files that might be on the device.
Leave technical response to the authorised team
The system owner may need to consider access restrictions, remote management or other protective measures. Do not improvise a wipe, reset or account change that could affect evidence or the coordinated response unless the approved procedure authorises it. Our IT roles guide provides context for the distinction between reporting a user problem and administering systems; the authorised team must decide device, account and access actions under the actual incident process.
If a device-location feature is involved, follow the responsible team’s instructions. A displayed location does not grant permission to enter premises or recover property personally.
Report any later discovery, message or sign-in alert promptly. The response team needs current facts, including whether the device has actually been recovered.
A fictional lost-laptop report
In this invented example, an employee cannot locate a work laptop after travelling between two authorised work locations. They report the missing asset and last known custody through the designated channel.
They state which work systems they used without guessing whether anyone else accessed the device. The responsible team determines protective steps and information-assessment needs. Recovery of the laptop later is reported as a new fact, not treated as proof that the incident had no implications.
Confirm the next work arrangement
Ask how to continue work through an approved device and access process. Do not copy workplace information to a personal account or borrow a colleague’s login to avoid a delay.
The responsible privacy or security team should decide any applicable notification questions. A missing device does not let an individual employee make a legal breach determination from a checklist. A useful report gives responders prompt, factual information and preserves a clear record of custody, actions and follow-up.
