When a work phone or laptop is lost or stolen, the instinctive way to think about it is as the loss of a piece of equipment, with a price attached and an insurance question behind it. That framing understates the problem considerably. The device is replaceable and its cost is known. What leaves with it is everything it was still signed in to: the mail, the accounting, the customer records, the file storage, the messaging the business runs on, and often the second factor that protects all of those. A modern work device is less a possession than a set of open doors, and the doors do not close because the device changed hands.
That is why the first hour matters more than anything that follows, and why what can be achieved in that hour is almost entirely determined by work done beforehand. If the device can be located, locked and erased remotely, the incident becomes an inconvenience and a purchase. If it cannot, the business is reduced to changing passwords one service at a time from memory, with no way of knowing which sessions are still live on the missing machine and no way to end them. The two situations are hours apart in effort and are separated by a single setting that takes a few minutes to turn on while the device is still in hand and is impossible to turn on afterwards.
So the preparation is short and worth doing today rather than after the fact. Make sure every work device has a screen lock that actually engages on its own, because a device that is never locked hands over everything the moment it is picked up. Turn on the manufacturer's find-and-erase facility on phones, tablets and laptops alike, and check once that it genuinely reports the device rather than assuming it does. Make sure the business's important data exists somewhere other than the device, so that erasing it remotely is a decision about security and not a decision about losing the only copy of the work. And write down, on paper or somewhere reachable without the missing device, the list of services the business depends on - because in the first hour that list is exactly what nobody can remember.
When it does happen, the order of actions is straightforward if it has been thought about in advance: locate and lock the device, erase it if it is clearly gone rather than merely mislaid, and then work down the list of services, signing out of all other sessions and changing the password on anything that was reachable from it, starting with the mailbox. The mailbox comes first for a reason that is easy to miss: it is usually the way every other password is reset, so an attacker with the mail has a route to everything else regardless of how strong the other passwords are. Handled in that order, with the preparation already in place, a stolen laptop is a bad afternoon. Handled without it, it can be a bad month.