Lost business phone: response plan

Lost work phone: first steps

Report a lost phone to the designated IT team with the time, device and data involved. Following the response procedure, the team assesses account blocking, session revocation, MDM action and contact with the carrier. Remote wiping requires an authorised decision considering evidence and private data. The data protection lead assesses breach reporting and notifications. Action order depends on risk and agreed authority, not a guaranteed number of minutes.

• The employee reports through one channel and provides last location, time and device status.
• The team locks the device, revokes sessions, tokens and certificates, and assesses data-exposure risk.

Which devices and data belong in scope

Scope should follow access to information and processes, not merely device ownership.

• Corporate smartphones and tablets managed by the company.
• Personal BYOD devices that access email, files or applications.
• Laptops used away from the office, shared devices and field-worker equipment.
• iOS, Android, Windows and macOS, including version, patch and encryption status.
• Local data, accounts, tokens, certificates, VPN profiles and business applications on the device.

The minimum control set for mobile devices

Baseline controls should operate before data is released, not only after the first device is lost.

• Enforced screen lock, strong passcode, biometrics and automatic session timeout.
• Storage encryption, secure boot and current operating-system and application versions.
• MFA and Conditional Access based on device compliance; user and sign-in risk policies require the applicable Microsoft Entra licensing.
• Remote lock, corporate-data wipe and revocation of active sessions.
• Separation of business and personal data plus controlled backup, export and sharing.

Technical so­lu­tions that should work together

No single tool secures the entire lifecycle. The layers need to exchange device, identity and event information.

How to avoid BYOD chaos

BYOD needs informed agreement from company and user, precise data separation and clear privacy rules.

• Define which roles and data may use a personal device and which require corporate equipment.
• Describe what administrators can see and separate corporate data with a container or work profile.
• Obtain policy acceptance before enrolment and explain the employee-offboarding process.
• Block copying to unapproved apps, clouds and personal backups.
• Provide an alternative for anyone who does not consent to management of a personal device.

The correct order for implementing safeguards

Address the highest-impact risks first, then extend automation and detailed policies.

• Identify devices with access to critical data and privileged accounts.
• Enforce MFA, encryption, screen lock and minimum operating-system versions.
• Introduce MDM/UEM enrolment and conditional access for successive user groups.
• After stabilisation, add app catalogues, automated deployment and advanced rules.

A phased action plan for the mobile environment

A phased plan reduces risk without suddenly cutting employees off from their tools. Any rollout dates are illustrative: do not postpone MFA, encryption or lost-device procedures when they are already required for safe access.

• Discovery and ownership: inventory corporate and BYOD devices, classify the data they handle, name service and data owners, and apply urgent restrictions where exposure is already known.
• Control implementation: pilot MDM/UEM with representative users, enforce MFA and conditional access, deploy role-based profiles and approve the lost-device procedure.
• Acceptance and evidence: expand only the controls that passed the pilot, measure compliance, exercise a lost or compromised device scenario, train users and give owners an exception and risk report.

Device register and audit trail

The company must be able to show which device accesses which data and whether it meets requirements.

• Identifier, owner, user, operating system, version, encryption status and last synchronisation.
• Assigned profiles, apps, certificates, data scope and risk level.
• History of compliance, exceptions, policy changes and process-owner approvals.
• Evidence of remote lock, device retirement, corporate-data wipe and session revocation.
• Report of inactive, unenrolled, outdated or non-compliant devices.

Device lifecycle from enrolment to retirement

Security must cover the whole period of use, including role changes, service, return and disposal.

• Enrol the device, confirm the user and assign the correct profile automatically.
• Distribute certificates, VPN, applications and settings without exposing shared passwords.
• Assess compliance regularly and manage exceptions with an owner and expiry date.
• Change the profile when the role, temporary project or sensitive-data access changes.
• Revoke access, erase data securely, return the equipment and update the register.

Follow-up after a device is lost or compromised

After the first response steps, verify that access has actually been restricted and assess whether data was exposed.

• An authorised responder decides whether to remove company data or wipe the device, considering ownership, management model, platform capabilities and evidence preservation.
• The team checks the result of the remote command; sending it alone does not confirm completion.
• Monitoring checks unusual sign-ins, downloads, MFA changes and policy-bypass attempts.
• Update the incident register, evidence, breach assessment and corrective actions after the event.

How to keep mobile data protection stable

Protection degrades as systems, applications and work patterns change, so it needs a regular maintenance rhythm.

• Review compliance, inactive devices, OS versions and exceptions every month.
• Pilot policy changes with communication plans and a way to restore the previous settings.
• Correct access and device profiles immediately after a role change or departure.
• Test the loss procedure, reporting and business-continuity recovery every quarter.

Risks without a structured mobile programme

Without a coherent model the company does not know the scale of access and cannot limit incident impact quickly.

• Data loss after theft of an unencrypted device with no remote lock.
• Account takeover through missing MFA, outdated apps or stored tokens.
• Copying files to a personal cloud, messenger or uncontrolled backup.
• Access by a former employee or old device absent from the register.
• No evidence of compliance during an audit, breach response or client review.

Typical MDM/UEM use cases

Policies should match the way people work instead of imposing identical rules on every user.

How to measure mobile-security effectiveness

Indicators should demonstrate actual control coverage, response speed and exception quality.

• Percentage of devices enrolled, encrypted, current and compliant.
• Percentage of sign-ins protected by MFA and conditional access.
• Time from loss report to device lock and session revocation.
• Number of exceptions, their owners, expiry dates and overdue actions.
• Number of unknown, inactive or still-authorised devices after a user change.

Acceptance criteria for the mobile rollout

Acceptance should prove configuration and process operation in a realistic scenario.

• A new device receives the correct profile, applications, certificates and access rules.
• A non-compliant device is restricted and the user receives clear remediation guidance.
• A loss test triggers lock, session revocation, ticket and a complete action trail.
• Corporate data can be wiped without breaching the agreed BYOD privacy scope.
• Register, policies, exceptions, instructions and responsibilities are handed to owners.

Related Virtline services

Mobile security needs coordinated management of devices, identity, cloud services and threat response.