A laptop leaves the premises: it can be lost or stolen. Microsoft presents BitLocker, the Windows encryption feature, as addressing the threats of data theft or exposure from lost, stolen or inappropriately decommissioned devices. Encryption is therefore part of the request, just like the intended use and accessories. Product names are mentioned only to describe the need.
Short answer
You describe the intended use, travel and the number of laptops: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote and supply the devices. Configuration, encryption and deployment are set with you.
What the quote should cover
- The number of laptops and their breakdown by user profile
- The configuration: processor, memory, storage, screen and operating system
- Turning on encryption and keeping the recovery keys
- Accessories: docking station, monitors, extra charger, carrying case
- The manufacturer's warranty, including what it covers in case of damage
- Preparation, delivery and handover to employees
- Collection and secure wiping of old laptops
Describe the use and mobility
Describe how employees work: mostly at the office with a docking station, hybrid, travelling to client sites or on construction sites. This guides the screen size, weight, battery life and ruggedness needed. Also list the software to run, how frequently employees join video calls and the ports needed for your peripherals.
For employees who connect to company resources from outside, the Secure remote access page describes the connection options.
Encryption and lost devices
According to Microsoft's BitLocker documentation, data on a lost or stolen device is vulnerable to unauthorized access, for example by transferring the drive to a different device. BitLocker encrypts entire volumes and renders data inaccessible when protected devices are decommissioned or recycled. Microsoft states that the Trusted Platform Module (TPM) works with BitLocker to ensure that a device hasn't been tampered with while the system is offline.
Ask the quote to state how encryption is turned on, where the recovery keys are backed up and who can access them. If you want to be able to lock or wipe a laptop remotely, the Microsoft Intune page describes these features.
Accessories and the home office
Accessories change how a laptop is used day to day: docking station, one or two monitors, keyboard and mouse, headset for calls, extra charger for home. Specify what each profile should receive, at the office and at home, and whether accessories must work with docking stations already in place.
Manufacturer's warranty
The manufacturer's warranty varies by model and by the options chosen. Ask for its length, the service method (on-site repair or shipping the device), battery coverage and the claim process. Also ask whether the proposed warranty covers accidental damage, such as a drop or a spill, or only manufacturing defects.
Deployment and Windows 11
To install or upgrade to Windows 11, the minimum requirements published by Microsoft include TPM 2.0 and UEFI Secure Boot capable firmware, among others; Microsoft also states that Windows 10 Home and Pro reached end of support on October 14, 2025. Deployment covers preparing the laptops, turning on encryption, installing software, transferring files and handing them over to employees.
Follow-up after handover (updates, inventory, departures) is part of device management.
Secure wiping of old laptops
According to the Canadian Centre for Cyber Security's publication ITSAP.40.006, deleting files is not enough: the data is still recoverable. A factory reset makes data inaccessible through the device's interface but does not truly erase it. The Centre describes other methods: overwrite and secure erase, crypto erase, which is suitable when encryption has been used from the beginning of the media's life cycle, and degaussing, which does not work on solid-state drives. For highly sensitive data, it recommends combining sanitization with physical destruction. A laptop encrypted from the start of its service lends itself to the crypto erase described by the Centre.
If the devices hold personal information, Quebec's Act respecting the protection of personal information in the private sector provides that once the purposes for which it was collected or used are achieved, the business must destroy or anonymize it, subject to any preservation period provided for by an Act (s. 23). The quote should specify the wiping method, who performs it and what document you receive.
What to specify in your request
- The number of laptops per user profile
- Ways of working: office, hybrid, travel, construction sites
- The software to run
- Accessories per profile, at the office and at home
- The manufacturer's warranty you want and damage coverage
- The number of old laptops to collect and wipe
You can then describe your project: the team will contact you to clarify your needs and provide a quote.
Frequently asked questions
Should company laptops be encrypted?
It is a measure to include in the request. Microsoft presents BitLocker as addressing the threats of data theft or exposure from lost or stolen devices. Ask where the recovery keys are backed up.
What if a laptop is lost or stolen?
If it held personal information, its loss may be a confidentiality incident within the meaning of section 3.6 of Quebec's Act respecting the protection of personal information in the private sector, and the business must then take reasonable measures to reduce the risk of injury (s. 3.5). The Incident response page describes the steps to follow.
Does the warranty cover damage?
It depends on the manufacturer's warranty and the options chosen. Ask the quote whether accidental damage is covered or only manufacturing defects.
How do I wipe a laptop before getting rid of it?
According to the Canadian Centre for Cyber Security's publication ITSAP.40.006, a factory reset does not truly erase the data. Crypto erase is suitable for encrypted drives if encryption has been used from the beginning of the media's life cycle.
How is this different from Microsoft Intune?
This page covers acquiring the laptops. Microsoft Intune is used to manage them once in service: policies, updates, remote lock and wipe.