# Lost event-website administrator device: response record

Use this card when an organizer's laptop or phone with event-site administration access is missing. The incident owner should adapt each action to the actual platform, device management, permissions and approved response plan. **Do not assume a remote action succeeded until its status is confirmed.**

## 1. Report and scope

| Question | Evidence / owner / time |
|---|---|
| Who reported the device missing, and when? | [ ] |
| Device ID, last known location, ownership and management platform | [ ] |
| Was the device encrypted, locked and managed? Evidence? | [ ] |
| Which person and administrator roles were signed in? | [ ] |
| Other lost items: security key, badge, backup codes, written credentials | [ ] |
| Authorized incident lead and alternate administrator | [ ] |
| Evidence of suspicious sign-in, account change or data access so far | [ ] |

## 2. Containment decision table

| System / role | Active device or browser session? | Local token, key or recovery material possible? | Containment chosen and authority | Completed status and evidence | Continuity owner |
|---|---|---|---|---|---|
| Identity provider / shared mailbox | [ ] | [ ] | [ ] | [ ] | [ ] |
| Event CMS and publishing | [ ] | [ ] | [ ] | [ ] | [ ] |
| Registrar and DNS host | [ ] | [ ] | [ ] | [ ] | [ ] |
| Hosting and cloud console | [ ] | [ ] | [ ] | [ ] | [ ] |
| Ticketing and registration | [ ] | [ ] | [ ] | [ ] | [ ] |
| Payment administration | [ ] | [ ] | [ ] | [ ] | [ ] |
| Code repository and deployment | [ ] | [ ] | [ ] | [ ] | [ ] |
| Analytics / marketing | [ ] | [ ] | [ ] | [ ] | [ ] |

For each service, check the provider's current device, session, token and recovery controls. Signing out a user from one identity provider may not end a separate application session. Consider managed-device lock or wipe only if supported, authorized and appropriate to the incident; record **requested**, **pending** and **confirmed** separately. Preserve the alternate authorized administrator and ticket-sale continuity before removing access where possible.

## 3. Verify, communicate, recover

| Check | Result / evidence / time |
|---|---|
| Identity and application logs reviewed for unexpected activity | [ ] |
| Session revocations or credential rotations verified at each service | [ ] |
| Event site, registration, confirmation and ticket delivery still work | [ ] |
| Unresolved exposure and local notification decision assigned | [ ] |
| Replacement device and least-privilege access approved | [ ] |
| Follow-up owner, due date and incident closure evidence | [ ] |

Device loss is not by itself proof of compromise or of a reportable data incident. Record the evidence and have the appropriate security, privacy or local legal owner decide the next step. Do not paste tokens, passwords or personal attendee data into this worksheet.