Treat loss as an evidence incident
A missing drive can create confidentiality, audit and contractual consequences even when protected. Respond from recorded facts: package scope, protection type, secret exposure, last custody event and recovery options. Do not promise that a password makes loss harmless.
A courier cannot confirm delivery. The coordinator freezes further secret disclosure, opens an incident, confirms the exact manifest and protection used, contacts the intended recipient, evaluates notification duties and records the final disposition.
Run the control in five steps
- 01Open an incident and preserve custody and shipment evidence.
- 02Stop or rotate any separately transmitted secret when possible.
- 03Confirm the exact package, classification and protection boundary.
- 04Escalate notification decisions to security, legal and audit owners.
- 05Document recovery, non-recovery and corrective actions.
Preserve an accountable audit trail
Record discovery time, reporter, device/package IDs, last custody event, evidence scope, protection/version, password-channel status, recipient contact, risk decision, notifications and closure approval.
Stop and investigate when
- The package manifest cannot be reconstructed.
- The secret traveled with the device.
- The incident is closed solely because a password was used.
State what the control does not prove
Do not equate with hardware-encrypted drives or untested Mac/Android compatibility. Validate the device, recipient environment, secret channel, plaintext residue and recovery workflow separately.
Audit handoff questions
Must every lost protected drive be reported externally?
Requirements depend on facts and jurisdiction; escalate to the responsible legal and security owners.
Can remote wipe be assumed?
No. Offline removable media usually cannot receive a remote command unless a separately verified capability exists.
Sources for this decision
Links support specific control decisions and do not imply endorsement.