Skip to content
Lost or Stolen Laptop? An Encryption and Device Management Checklist for Mid-Market Owners and Operators

Lost or Stolen Laptop? An Encryption and Device Management Checklist for Mid-Market Owners and Operators

2026-10-31 · By the Yellow Coop Team

Somewhere right now, a company laptop is on a car’s back seat under a gym bag for “security.” The takeaway up front: assume every laptop will eventually be lost or stolen, and set things up so that day is a hardware expense and a password reset, not a data breach. That means full-disk encryption on every device, recovery keys stored away from the laptop, central device management, and a written plan for the first hour after someone says “I can’t find my laptop.”

Why encryption is the control that changes the outcome

A few plain definitions:

  • Full-disk encryption (FDE): NIST describes it as encrypting all the data on a drive, with access granted only after successful authentication. Without the key, a thief gets an expensive paperweight.
  • Recovery key: the backup key that unlocks an encrypted drive if the normal login fails.
  • Device management (MDM/EMM): software that lets IT see, configure, lock, and wipe company devices from a central console.

The clearest lesson comes from health care, where regulators publish the details. On April 21, 2017, Rhode Island’s Lifespan filed a breach report after an affiliated hospital employee’s laptop was stolen. It held names, medical record numbers, demographic information, and medication information for 20,431 people. The HHS Office for Civil Rights (OCR) found Lifespan had failed to encrypt data on laptops after determining it was “reasonable and appropriate” to do so, and lacked device and media controls. Lifespan agreed to pay $1,040,000 and follow a corrective action plan, announced July 27, 2020.

This isn’t a 2017 problem. OCR’s annual breach report to Congress for calendar year 2024 says the most reported thefts were of laptops and paper records, and that laptop incidents mostly “resulted from a lack of proper security measures, such as a lack of access controls.”

Here’s why encryption matters so much. Under HHS guidance, health data encrypted consistent with NIST SP 800-111, with the key not compromised, is not considered “unsecured,” so HIPAA breach notification isn’t required if it’s lost. The FTC’s Safeguards Rule, which covers financial institutions under FTC jurisdiction (its examples include tax preparers and mortgage brokers), takes a similar approach. It requires encrypting customer information at rest and in transit (16 CFR 314.4(c)(3)), and it defines a reportable “notification event” as acquisition of unencrypted customer information (16 CFR 314.2(m)). One catch: if an unauthorized person gets the key, the data counts as unencrypted.

Not in health care or finance? These rules still show how regulators view a missing laptop.

The checklist

1. Know every laptop you have

You can’t encrypt what you don’t know exists. List every company laptop, who has it, and whether it’s managed. The Safeguards Rule requires covered businesses to “identify and manage the data, personnel, devices, systems, and facilities” they rely on (16 CFR 314.4(c)(2)).

2. Turn on full-disk encryption, and prove it

Enforce full-disk encryption through device management so it isn’t optional, and pull a monthly report showing encryption status for every device. Lifespan’s corrective action plan included written reporting to OCR on device encryption. Make that report boring and routine.

NIST SP 800-111 (November 2007) is old but is still the current version, and it’s the one HHS guidance points to.

3. Store recovery keys away from the laptop

NIST SP 800-111 warns that if a key is lost or damaged, “it may not be possible to recover the encrypted data.” HHS guidance says decryption keys should be stored separately from the data. Escrow recovery keys in your management console or identity system. A sticky note in the laptop bag does not count.

4. Enroll every device in management

Management lets you lock or wipe a device remotely, push settings, and confirm encryption. But don’t oversell remote wipe. NIST SP 800-124 Rev. 2 (May 2023), written for mobile devices, says that by itself “remote wipe is a fundamentally unreliable security control,” because an attacker can power the device off before the wipe command arrives. Encryption protects the data. Wipe is a second layer.

5. Set auto-lock and strong sign-in

NIST’s mobile guidance lists auto-locking devices after an idle period as a policy to enforce. Do the same on laptops, and require multi-factor authentication (MFA) on company accounts so a stolen laptop isn’t a stolen login.

6. Write the “lost laptop” runbook

Keep it to one page:

  1. The employee reports the loss to IT right away, any hour. No blame for reporting.
  2. IT sends the lock or wipe command and notes the time.
  3. IT signs the user out of email, cloud apps, and VPN, and resets passwords.
  4. IT confirms from the console that the device was encrypted, and records the evidence.
  5. If the device wasn’t encrypted or the key may be exposed, escalate to your incident response plan and legal counsel.
  6. If it was stolen, file a police report.

FTC-covered businesses must have a written incident response plan anyway (16 CFR 314.4(h)). This is a good page to add to it.

Conclusion

Laptops get lost. Encrypt every one, keep the keys elsewhere, manage them centrally, and practice the runbook once so it isn’t improvised in a parking lot.

If you’d like help, Yellow Coop’s Chief Information Officer work starts with an inventory of systems, licenses, and contracts with owners, and our Chief Information Security Officer work includes a written incident response plan with a leadership tabletop exercise, plus cyber insurance application support and a control gap list. You can get that through Virtual advisory hours or a Fractional engagement of 1 to 4 days a week. Book a first call to see which fits.

Sources