Asset and laptop usage policy: issue, care, loss and return

A developer resigns on a Friday. Her laptop is collected on Monday, wiped by a junior on Tuesday and handed to a new joiner on Wednesday. Two weeks later someone asks for the client files that were on it. There is no copy, no log and no record of who approved the wipe. A policy would have had a return checklist, a data backup step and a signed handover.

An asset and laptop usage policy manages company-owned laptops, phones, monitors, access cards and other equipment from the day they are bought to the day they are disposed of. It supports the IT and internet usage policy and the password and access control policy, and connects to the resignation and exit policy. We draft and review such documents under HR policies and governance.

List the types the policy covers: laptops and desktops, phones and tablets, monitors and peripherals, SIM cards and data cards, access cards, test devices, furniture and any item worth tracking. Add a threshold below which an item is a consumable and not recorded individually. The company sets this threshold.

1. 1

   Asset eligibility

   Decide which roles get which assets. A developer may need a high-spec laptop, a sales executive a phone, a trainee a shared device. Write the rule by role, not by who asks loudest.

2. 2

   Standard configurations

   Fix a small number of laptop builds. Fewer builds make support, spares and replacement easier. Exceptions need written approval from a named person.

3. 3

   Maintenance responsibility

   Say who repairs what. Usually the IT administrator handles faults and the employee reports them quickly. Make clear that staff do not open devices or use outside repair shops.

4. 4

   Replacement cycles

   Choose how long a device stays in service before review. A longer cycle saves money but increases breakdowns. Record the purchase date on the asset register so the review is automatic.

Each asset gets a unique tag number, a serial number in the register and a named holder. The employee signs an asset acknowledgement form listing the item, accessories, condition, date and the policy version. Temporary transfers, such as lending a laptop to a colleague for a client visit, are recorded the same way. Without a record, loss cannot be traced.

• Keep devices with you or locked away. Never leave one in a car or an unattended meeting room.
• Do not lend a company device to family or friends.
• Limited personal use is allowed only as the policy states, and never for activity that is unlawful or that exposes the company.
• Install software only from the approved list. Unlicensed or unknown software is not allowed.
• Accept security updates when prompted. Do not disable antivirus, endpoint protection or the screen lock.
• Full disk encryption is on for every laptop before it is issued.
• Store business files in approved company storage, not on a desktop or a personal drive.
• Personal devices for work: decide whether they are allowed at all, and if so, what must be installed and what the company may remove.

1. 1

   Report at once

   The employee tells the IT administrator and the manager the moment a loss or theft is noticed. Delay increases the risk to data.

2. 2

   Contain

   IT locks the accounts, revokes sessions and triggers a remote wipe if the device supports it.

3. 3

   Record

   The employee writes a short incident statement. For theft, a police complaint is filed where appropriate.

4. 4

   Assess

   The reviewer decides whether the loss was beyond the employee's control or came from carelessness.

5. 5

   Decide on recovery

   Management decides on any cost recovery, only if the law and the employment contract allow it. Many companies absorb accidental loss and keep recovery for clear negligence.

At exit, the asset is returned on or before the last working day, checked against the acknowledgement form, and signed off by IT on the clearance checklist. Business data is backed up to the manager's folder first. Only then is the device wiped securely, reissued or disposed of, with a certificate or log of the wipe. Dispose of old devices through a method that destroys data.

Run an inventory check of the asset register against physical devices at set intervals, and investigate any gaps. A device on the register that nobody can find is a data incident until proven otherwise.

• Asset register with tag, serial number, holder, purchase date and status.
• Asset acknowledgement form.
• Transfer and return forms.
• Incident statement and loss report.
• Wipe and disposal log.
• Employee acknowledgement: read, understood and accepted, with date and policy version.

1. Purpose: manage the issue, use and return of [company name] assets.
2. Scope and types: laptops, phones, access cards, [other items].
3. Eligibility: by role, as listed in [annex].
4. Issue: tag, register entry and signed acknowledgement.
5. Care and security: encryption, updates, approved software, no lending.
6. Personal use and personal devices: [allowed or not, with conditions].
7. Repair and replacement: IT administrator; review after [number] years.
8. Loss or theft: report within [number] hours to [role].
9. Cost recovery: only where the law and contract allow, decided by [role].
10. Return, wipe, audit, review and version.