Answer
Revoke active sessions, tokens, certificates, or trusted device status and rotate secrets that may have been exposed.
Explanation
Changing only the user's password may not invalidate every persistent credential stored on the missing device.
Drone exam · Security