A person changes several work passwords after a suspicious download, then continues using the same device. If the environment is still under investigation, the account task may have moved faster than the endpoint response.
The team needs a coordinated plan for both. A new secret is not a health check for the device where it is entered.
Establish why the endpoint is in question
A credential exposure finding alone does not identify an infected computer. A suspicious executed file, independent endpoint alert, or other authorized evidence can justify a separate device investigation.
NIST's incident-response recommendations provide the broader framework for coordinating response and recovery. Apply the organization's approved endpoint procedure rather than improvising a cleanup from a credential alert.
Record what is observed, who controls the device, and which team is authorized to assess it.
Provide a known-good recovery route
For a hypothetical employee whose laptop is under review, the organization might provide a managed replacement or another approved environment for recovery and work.
The response team should decide the sequence based on current risk. Urgent access containment may need to happen before the endpoint investigation is complete; the user should not be left to choose between business continuity and unsafe improvisation.
Do not ask the employee to clear a few browser files and treat that as proof of device integrity.
Coordinate account actions explicitly
Identify the accounts and services that need review through authorized records. Review password changes, sessions, recovery settings, and relevant application grants as separate items.
If a password manager is involved, follow its documented administrative and recovery process. Never ask the user to disclose the master secret to a technician.
For a personal device or contractor-owned endpoint, respect the agreed investigation boundary and involve the appropriate owner. Work-account authority is not unrestricted permission to inspect private data.
Define return-to-work evidence
The endpoint owner should explain the approved restoration or replacement outcome. The identity owner should confirm the relevant access actions. The business owner should know whether the employee can resume the intended work.
Keep those confirmations separate so one team does not unknowingly certify the other team's result.
A useful closeout states which device concern was assessed, which account actions were verified, and what remained outside the available evidence. It does not claim the original exposure mechanism was proven unless the investigation actually established it.
Read password managers and device risk and work access on personal devices. Effective recovery is a coordinated handoff to a trusted working state, not a race to complete the password-reset checklist.