Because the client still offline we can’t send wipe code to the client, IR Team starting discuss again and concluded that the lost laptop is not have any activity, it means people who get the laptop maybe can’t access, anyway we should observe and track activity around 2-3 day if not have any sign from the laptop IT-NetAdmin will disable NAT and close port 3.