Identity, Access & Endpoint Security

A laptop left unattended may have been accessed, tampered with, or removed briefly even if it is returned. The response depends on device lock state, encryption, custody, and whether sensitive sessions were active. What to check Record the location and duration, device management and encryption status, screen lock, user sessions, recent sign-ins, and...

A reassigned phone may retain email sessions, authentication tokens, contact data, and app caches from its previous user. A factory reset alone may not remove cloud-side access or recoverability settings. What to check Review device ownership, management state, encryption, app profiles, account sessions, certificates, and backup status. Confirm...

A temporary worker may use a device that retains prior profiles, certificates, or access. Temporary status can make ownership and access expiry easy to overlook. What to check Check device assignment, wipe and enrollment status, encryption, patching, user profile, account expiry, role-based access, and return logistics. Confirm manager sponsorship and...

A laptop returned to a shared pool can retain user profiles, offline files, browser tokens, and certificates. A new employee might gain access to data left by the previous user. What to check Check asset return, encryption, local profiles, synced folders, browser state, authentication certificates, endpoint health, and outstanding legal or retention...

Travel can increase the risk of device loss, border inspection, insecure networks, or access from unusual locations. Employees may carry more local data than they need for the trip. What to check Review destination and business need, data sensitivity, device encryption, travel policy, MFA, remote wipe, local admin, and access restrictions. Confirm any...

A SIM replacement can be part of a normal carrier change or a sign of account takeover. Business calls, SMS-based recovery, and authentication codes may be redirected. What to check Verify the change with the employee through an independent method, check carrier notifications, identity sign-ins, account recovery activity, and device status. Confirm...

A retired device may still contain business data, certificates, or management links. A normal file deletion or account sign-out does not ensure that data is unrecoverable. What to check Confirm asset ownership, encryption and key state, legal retention, device management, removable media, and approved disposal process. Check whether the device can be...

Disabling one login may leave active sessions, API tokens, shared accounts, or access through a separate SaaS identity. Incomplete offboarding can leave accounts unnoticed. What to check Use the approved offboarding record to enumerate identity provider groups, direct app accounts, sessions, keys, shared secrets, devices, and delegated access. Confirm...