Loss and Theft

A personal phone is stolen. The employer wants the company data gone immediately. The employee wants their photographs back and has not yet given up on recovery. Both are reasonable and they point in opposite directions.

The operational issue in “Loss and Theft” is easier to diagnose when device state and work evidence remain separate. A team reviewing visit the product website for employee monitoring data security can make time and project context visible, while endpoint tools remain the source of truth for security, software and hardware condition.

The first hour

What the employer needs: revoke the device's access to company systems, which is immediate, reversible and touches nothing on the device.

For an independent reference relevant to “Loss and Theft”, consult the CISA mobile-device security guidance; compare its principles with the proposed ownership model, access rules and real support process.

What the employee needs: the device's own find-my-device function, which may locate it or allow them to lock it, and which works better if nothing has been disturbed.

These two are compatible. Access revocation does not interfere with recovery, and doing it first costs nothing.

What is not compatible is an immediate whole-device erase, which destroys the employee's data and ends any chance of recovery. That should not be the first action and under a container arrangement it is not the available action.

Why reporting speed matters more than anything else

Every control depends on the employer knowing. A device reported in an hour is a manageable event; one reported after a weekend is not.

Which means the arrangement has to make reporting easy and consequence-free. A person who fears being blamed, charged for the device, or disciplined will delay, and the delay is far more damaging than anything they did.

State explicitly: report it immediately, you will not be charged, you will not be in trouble. That sentence buys more security than most technical controls.

The sequence worth writing down

Revoke access. Confirm whether the work profile space can be removed remotely and do so. Let the employee attempt recovery of the device itself. Record what happened, what data was on it, and when.

That last step matters because loss of a device holding personal data may trigger notification duties, and the assessment depends on what was actually on it — which is a question nobody can answer unless the arrangement knows what the device held.

What the employee loses

Their property, which the employer did not insure and their household policy may not cover for business use.

Possibly their own data, if they had no backup.

The repair-and-insurance note covers the money; what belongs here is that the employer should say in advance whether it contributes to replacement after a theft that happened during work.

Most do not, and most have never been asked, and the first time it arises is a bad moment to decide.

The data that was on it

Assessing a loss requires knowing what the device held, and under BYOD nobody does. A container arrangement at least bounds the answer to the work space; synchronised local copies do not. This is one of the practical reasons the access-only arrangement in the later section resolves so much: a lost device holding nothing requires no assessment at all.

After the event

A short review of each loss — what was on it, how quickly it was reported, what worked — takes minutes and improves the next one. Most organisations handle a loss, feel relieved, and record nothing, which means the same gaps are discovered again the following year by somebody else.

The notification duty

Where a lost device held personal data, an assessment of whether notification is required may be needed, and it depends on what was on the device and whether it was encrypted. Knowing both in advance — through the configuration rather than through recollection — is what makes that assessment quick rather than fraught.

The assurance that has to come first

Nobody reports a loss quickly if they expect to be charged for it or blamed. Stating the opposite, in advance and plainly, is the control that makes every other control in this note possible, and it costs the organisation nothing but the words.

The control that matters most here is not technical. It is that somebody who has just lost a phone picks up the other one and tells you, within the hour, without dreading it.