How are employee laptops secured?

For a company whose product runs in the cloud, the laptop is often the weakest link in an otherwise reasonable posture: it holds credentials, sometimes exports of customer data, and it leaves the building every evening.

Four things make a complete answer, and they are the four a reviewer scores: full-disk encryption, automatic screen lock, enforced operating system updates, and the ability to revoke or wipe. Antivirus is worth a mention and is no longer the point. If you can say all four are enforced centrally rather than requested politely, that is the strongest version.

Enforced is the operative word. A policy stating that laptops must be encrypted is not the same as a management tool reporting that they are. Small teams frequently have the policy and not the tool, in which case the honest answer says the policy exists and compliance is checked at onboarding. That is materially weaker, and it is also true, and it will not fall apart when somebody asks how many devices are currently compliant.

Bring-your-own-device is the question underneath the question. If contractors or founders use personal machines to reach production, say so and say what compensates: access through a browser only, no local data, short-lived credentials, hardware-backed multi-factor authentication. A reviewer who is told about it and given the mitigation is in a very different position from one who finds out later.

Revocation ties back to offboarding. If the laptop cannot be wiped remotely, then removing the account and rotating credentials is what actually protects you, and saying which of the two you rely on is a better answer than implying both.

The cheapest improvement. Enrolling devices in the management tool your identity provider already includes usually takes an afternoon and converts this answer, and the two adjacent ones about mobile devices and removable media, from implied to confirmed. It is one of the few controls on any questionnaire where the work is smaller than the paperwork around it.