Laptop Setup SOP Template

1.Purpose

To make sure every laptop issued to an employee is imaged, secured with the standard baseline, enrolled in device management, tracked as an asset, and ready to use before it is handed over.

2.Scope

Applies to allocating a laptop from stock, imaging, security configuration, device management enrollment, and handover for new hires and device replacements. User account creation in the identity provider is covered by a separate procedure.

Definitions

Golden image

The standard operating system image with baseline software and settings used to set up new devices.

MDM

Mobile device management, the platform used to enforce security policy and manage devices remotely.

Asset tag

A unique identifier attached to a device and recorded in the asset register.

Security baseline

The minimum set of security controls, such as disk encryption and screen lock, applied to every device.

3.Responsibilities

System Administrator

Images the device, applies the security baseline, and enrolls it in MDM.

Service Desk Analyst

Confirms hardware requirements, hands over the device, and walks the new hire through setup.

Asset Manager

Allocates hardware from stock and maintains the asset register.

New Hire

Receives the device, signs the handover form, and completes first login.

RACI matrix

R = Responsible, A = Accountable, C = Consulted, I = Informed

4.Materials and PPE

Materials, tools and systems

• →Golden image and imaging tool
• →MDM console
• →Asset register
• →Device handover form
• →Standard software bundle list
• →Security baseline checklist

5.Procedure

1. 5.1

   Confirm hardware requirements

   Service Desk Analyst

   The Service Desk Analyst confirms the laptop specification requested matches the role's standard hardware requirements before allocation.

2. 5.2

   Allocate the laptop

   Asset Manager

   The Asset Manager allocates a laptop from available stock, or places a purchase order if stock is unavailable and updates the expected delivery date.

3. 5.3

   Record the asset

   Asset Manager

   The Asset Manager records the asset tag, serial number and intended assignment in the asset register before the laptop leaves inventory.

   Checkpoint: The device is recorded in the asset register with a valid asset tag before it is issued to anyone.

4. 5.4

   Image the laptop

   System Administrator

   The System Administrator images the laptop with the current golden image, including the operating system and baseline configuration.

5. 5.5

   Enroll in MDM and encrypt

   System Administrator

   The System Administrator enrolls the device in MDM and applies the security baseline, including full-disk encryption, screen lock and antivirus.

   Checkpoint: Full-disk encryption is confirmed enabled and reporting compliant in the MDM console before proceeding.

6. 5.6

   Install the software bundle

   System Administrator

   The System Administrator installs the standard software bundle plus any role-specific applications listed in the request.

7. 5.7

   Configure MFA and conditional access

   System Administrator

   The System Administrator configures multi-factor authentication and confirms the device passes the MDM compliance checks required for conditional access to email and applications.

   Warning: A device that fails MDM compliance checks must not be allowed to access company email or business applications.

8. 5.8

   Apply the latest security patches

   System Administrator

   The System Administrator applies all available operating system and application security patches before handover.

9. 5.9

   Perform a functional test

   System Administrator

   The System Administrator tests Wi-Fi, camera, keyboard, ports and battery to confirm the hardware is fully functional.

10. 5.10

    Hand over the laptop

    Service Desk Analyst

    The Service Desk Analyst hands over the laptop to the new hire along with a device handover form describing its condition and included accessories.

    Checkpoint: The new hire signs the handover form confirming receipt and the device's condition.

11. 5.11

    Walk through first login

    Service Desk Analyst

    The Service Desk Analyst walks the new hire through first login, MFA enrollment and basic security practices such as locking the screen when stepping away.

12. 5.12

    Update the asset register

    Asset Manager

    The Asset Manager updates the asset register status to assigned and files the signed handover form.

13. 5.13

    Schedule return and re-imaging

    Asset Manager

    When an employee departs or a device is replaced, the Asset Manager schedules the laptop for return, wiping and re-imaging before it is reissued.

6.Quality checks

• →Every laptop is enrolled in MDM with full-disk encryption confirmed before handover.
• →The asset tag and serial number are recorded before the device is assigned.
• →The new hire signs the handover form before leaving with the device.
• →Security patches are applied and the software bundle is installed before first use.

7.Records

• →Asset register entry
• →Signed device handover form
• →MDM enrollment confirmation
• →Security baseline checklist

8.KPIs

• →Percentage of laptops ready before the employee's start date
• →Average setup time per laptop
• →MDM enrollment compliance rate
• →Number of devices returned without being re-imaged

9.Common mistakes

• →Handing over a laptop before confirming full-disk encryption is actually enabled.
• →Skipping the asset register entry when a device is issued quickly.
• →Reissuing a previous employee's laptop without wiping and re-imaging it.
• →Not testing hardware before handover, leaving faults for the new hire to discover.

10.Revision history