A trade secret only exists in law while its owner can show it took reasonable steps to keep it secret, so weak security can destroy the legal right as well as the information. The US Defend Trade Secrets Act, the EU Trade Secrets Directive (EU) 2016/943 and the UK Trade Secrets (Enforcement, etc.) Regulations 2018 all make protection conditional on the holder's own conduct. This guide translates that "reasonable measures" or "reasonable steps" test into security controls, evidence and monitoring that a court, an investigator or a buyer in due diligence can see. It is written for security leaders, legal counsel and engineering managers who hold source code, formulas, models, pricing, customer data and process know-how. Labelling schemes are covered in the Data Classification Guide; this page focuses on what makes the legal claim stand up.
Key takeaways
- Reasonable measures are an element of the right. Under 18 U.S.C. 1839(3)(A) and Article 2(1)(c) of the EU Directive, information without proportionate protection is not a trade secret at all.
- Evidence matters as much as controls. An access policy you cannot show was enforced, or an NDA you cannot find, helps little when a departing employee walks out with a repository.
- Identify the crown jewels first. Courts expect protection proportionate to value; you cannot protect everything at the highest level, and trying to weakens the claim for what really matters.
- Machine identities count. CI tokens, service accounts and AI tools with read access to code or research data are part of the access population and must be inventoried and scoped.
- Plan the departure window. Exit interviews, access removal and a review of recent downloads are among the most common points where trade secret cases are won or lost.
What the law requires
The three main regimes use very similar tests. Each requires secrecy, value that comes from that secrecy, and protective effort by the holder.
| Element | US: 18 U.S.C. 1839(3) (DTSA) | EU: Directive 2016/943, Art. 2(1) | UK: SI 2018/597, reg. 2 |
|---|---|---|---|
| Secrecy | Not generally known to, and not readily ascertainable through proper means by, others who could gain value | Not generally known among or readily accessible to persons in the circles that normally deal with that information | Same wording as the Directive |
| Value | Independent economic value, actual or potential, from not being generally known | Commercial value because it is secret | Commercial value because it is secret |
| Holder's conduct | The owner "has taken reasonable measures to keep such information secret" | Subject to "reasonable steps under the circumstances" by the person lawfully in control | Subject to reasonable steps under the circumstances |
| Lawful routes for others | Reverse engineering and independent derivation are not improper means (1839(6)(B)) | Independent discovery and reverse engineering of a lawfully held product are lawful (Art. 3), unless validly restricted by contract (recital 16) | Follows the Directive |
| Time limit to sue | 3 years from discovery or when it should have been discovered (1836(d)) | Set nationally, not more than 6 years (Art. 8) | Within the Directive's 6 year cap |
The categories of protected information are wide. The DTSA lists financial, business, scientific, technical, economic and engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs and codes, however stored. WIPO adds that a combination of elements that are each public can be a trade secret when the combination is secret, which is how many data sets and machine learning pipelines are protected.
Two limits shape the security programme. First, trade secrets do not stop independent development or lawful reverse engineering, so anything that ships in a product a competitor can buy and analyse needs other protection. Second, the EU Directive (Art. 5) excludes relief where disclosure was made to reveal wrongdoing in the public interest, for freedom of expression, or to worker representatives. Monitoring and confidentiality terms must not be designed to silence protected disclosures.
Turning "reasonable measures" into controls
No statute lists the measures. What counts is proportionality: what a careful holder of that kind of information, in that sector and of that size, would do. WIPO gives the core examples as confidentiality agreements, strong IT security and restricting access to important documents. The table maps those expectations to concrete controls and to the evidence each produces.
| Measure | Security control | Evidence to keep |
|---|---|---|
| Know what the secrets are | A trade secret register: each asset, owner, location, value rationale and protection level | Register entries with dates and owner sign-off |
| Restrict access to need to know | Dedicated groups or repositories for secret assets, no "all staff" access, approval workflow for new members | Access lists, approval tickets, quarterly access review records |
| Bind people legally | Confidentiality clauses in employment and contractor terms, NDAs with partners before disclosure | Signed agreements indexed to the people on the access list |
| Mark the material | Visible and metadata labels such as "Confidential: Trade Secret" on documents, repositories and data sets | Label policy and label coverage reports |
| Control egress | DLP on email, web upload, USB and generative AI tools for labelled content; block personal cloud storage | DLP policies, alert history, exceptions with approvals |
| Strong authentication | Phishing-resistant MFA for repositories and research systems; short-lived tokens for automation | Conditional access policies, token lifetime settings |
| Log and review | Audit logging of reads, clones, exports and bulk downloads from secret stores | Retained logs and evidence of periodic review |
| Train | Briefings for people on secret projects about what is secret and how to handle it | Attendance records and acknowledgement |
| Manage departures | Same-day access removal, device return, reminder of obligations, review of recent activity | Leaver checklist, exit acknowledgement, activity review notes |
Proportionality by asset tier
Separate a small set of crown jewels from general confidential information. A useful pattern is three tiers: Tier 1 (for example a manufacturing process, core model weights or a pricing algorithm) with named-person access, hardware-backed MFA, no download to unmanaged devices and alerting on any bulk access; Tier 2 (customer lists, roadmaps, internal source code) with group access, labels and DLP; and Tier 3 general internal information under normal controls. Courts look at whether the claimed secret was actually treated differently from ordinary internal data.
Where identity fits
Most trade secret losses use valid access rather than a break-in (ATT&CK T1078 Valid Accounts). The access population includes far more than employees.
- Contractors and partners: external accounts with the same group memberships as staff, often never reviewed. Give them expiry dates and sponsor ownership. See the Insider Threat and Identity Guide.
- Non-human identities: CI/CD tokens, deploy keys, service accounts and backup jobs that can read source code or research data. A leaked token is a copy of the secret store. Scope each to one repository or bucket and rotate on a schedule. See the Secrets Management Guide.
- AI assistants and agents: coding assistants, enterprise search and agents connected to document stores inherit whatever access they are given. Exclude Tier 1 stores from AI indexing unless the tool is approved for that tier, and block pasting labelled content into public AI services. See the Generative AI Data Loss Prevention Guide.
- Former staff: personal access tokens, SSH keys and OAuth grants created by an employee can outlive the account. Revoke them at departure, not just the directory login.
Implementation: a phased approach
- Discover (weeks 1-4). Interview business and research leaders to list candidate secrets. For each, record owner, where it lives (repositories, shares, SaaS, laptops, supplier systems) and why secrecy gives value. Do not try to be exhaustive; 20 well-documented entries beat 500 vague ones.
- Legal baseline (weeks 2-6). With counsel, check employment and contractor terms carry confidentiality obligations, confirm partner NDAs exist before disclosure, and check that US agreements include the whistleblower immunity notice your counsel requires for the DTSA.
- Lock down Tier 1 (weeks 4-10). Move each Tier 1 asset into a dedicated, access-controlled location. Remove broad groups, enforce MFA, restrict download and sync, and scope every machine credential that touches it.
- Label and monitor (weeks 8-14). Apply labels, then turn on DLP in audit mode for two to four weeks to see normal behaviour before blocking. Tune false positives with the asset owners.
- Enforce (from week 14). Move DLP rules to block or justify for Tier 1, keep audit for Tier 2. Agree an exception process with approver and expiry.
- Operate. Quarterly access reviews per Tier 1 asset, annual register review, leaver process with activity review, and a yearly tabletop of a departing engineer scenario.
Rollback: if a blocking rule stops legitimate work, switch that rule back to audit and keep logging rather than deleting it; a gap in logging is worse evidence than a period of audit-only.
Decision guidance
| Situation | Option A | Option B | How to choose |
|---|---|---|---|
| Protecting an invention | Keep as trade secret | Patent | If the product reveals the invention on inspection, a trade secret will not survive reverse engineering; if it can stay hidden (a process, a recipe, server-side code), secrecy can last indefinitely |
| Sharing with a supplier | Share the full specification under NDA | Share only the part needed, split across suppliers | Split knowledge for Tier 1 material; NDA alone for Tier 2 |
| Source code access | Monorepo open to all engineers | Restricted repositories for core components | Open access speeds work but weakens any claim that core algorithms were secret; restrict the few components that are genuinely Tier 1 |
| Monitoring staff | Broad user activity monitoring | Targeted logging on secret stores | Targeted logging is easier to justify under privacy law and gives cleaner evidence; see the privacy note below |
Small organisations can meet the standard with a short register, a dedicated private repository or folder with named access, signed confidentiality terms, MFA and a leaver checklist. Large organisations are expected to do more: formal labelling, DLP, insider risk analytics and supplier controls. In the UK and EU, monitoring employees engages data protection law, so document the purpose, keep it proportionate and tell staff what is logged.
Suppliers, partners and joint development
Trade secrets leak through the supply chain as often as through employees: contract manufacturers, outsourced developers, consultants, prospective acquirers in due diligence and joint development partners all receive material. Disclosure to a third party does not end protection if it is made under obligations of confidence, but it does have to be controlled.
- Before disclosure: an NDA that names the categories of information, permitted purpose, return or destruction at the end, and audit rights for Tier 1 material.
- Share through controlled channels: a dedicated data room or extranet with named accounts, watermarking, view-only access and download logging, rather than email attachments.
- Minimise: give each supplier only the part of the process or design it needs. Splitting a process across suppliers means no single partner holds the whole secret.
- End of relationship: revoke accounts, keys and API access, obtain written confirmation of return or destruction, and keep that confirmation with the register entry.
See the Third-Party Risk Management Guide for the wider supplier assurance process.
When you suspect misappropriation
The first days decide what evidence exists. Preserve logs, device images and mailbox content for the people and identities involved before accounts are deleted, and bring in legal counsel at once, because remedies depend on speed. Under the DTSA a court can order ex parte civil seizure only in extraordinary circumstances, on specific findings including that an ordinary injunction would be evaded and that the target would destroy or hide the material, with a hearing set within 7 days (18 U.S.C. 1836(b)(2)). Injunctions cannot simply stop a person taking a new job, so the case has to rest on evidence of what was taken, not on what someone knows. Damages can include actual loss and unjust enrichment, or a reasonable royalty, and up to twice that amount where misappropriation was wilful and malicious. The Insider Data Theft Response Playbook sets out the evidence steps.
Detection and measurement
Watch the routes data leaves by: web upload and cloud sync (T1567, T1567.002), USB (T1052.001), and bulk reads from repositories and document stores (T1213, T1530).
- Signals: repository clones or archive downloads well above a user's baseline, mass export from CRM or PLM systems, uploads of labelled files to personal cloud or AI services, new forwarding rules to personal email, and access spikes in the weeks before a resignation.
- Machine identity signals: a CI token used from an unfamiliar network, a service account reading repositories it never touched before, or a deploy key used after its project was archived.
| Metric | Target |
|---|---|
| Tier 1 assets with a named owner, register entry and completed access review in the last quarter | 100% |
| People with Tier 1 access who have a signed confidentiality obligation on file | 100% |
| Machine credentials with Tier 1 access that are scoped to a single resource and rotated in policy | Above 95% |
| Leavers with access removed on the last day and recent activity reviewed | 100% for Tier 1 holders |
| Labelled-content DLP alerts triaged within agreed time | Above 90% |
Common failure patterns
- Claiming everything is secret. Marking every document "confidential" makes the label meaningless and invites the argument that nothing was treated as special.
- Agreements that cannot be found. The NDA existed, but nobody can produce the signed copy for the engineer who left.
- Broad engineering access. Core algorithms in repositories readable by every employee and contractor, plus long-lived tokens held by build systems.
- Pasting into public AI tools. Staff paste proprietary code or documents into consumer generative AI services, creating copies outside your control.
- Departure handled by HR alone. The account is disabled but personal access tokens, OAuth grants and synced laptop folders are left, and nobody reviews downloads from the last month.
- Logs not retained. When a dispute arises months later, the audit trail for the relevant period has already rolled off.
Framework mapping
| Measure | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Trade secret register | ID.AM-07 | RA-2, PM-5 | 5.9, 5.12 |
| Need-to-know access | PR.AA-05 | AC-3, AC-6 | 5.15, 8.3 |
| Confidentiality agreements | GV.OC-03 | PS-6, PS-7 | 6.6 |
| Egress control and DLP | PR.DS-01, PR.DS-02 | SC-7, AC-21 | 8.12 |
| Logging and review | DE.CM-03 | AU-6, AU-12 | 8.15, 8.16 |
| Training | PR.AT-01 | AT-2 | 6.3 |
| Departures | PR.AA-01 | PS-4 | 6.5 |
Practitioner checklist
- Build a trade secret register with owner, location and value rationale for each Tier 1 asset.
- Confirm signed confidentiality terms for everyone with Tier 1 access, and index them so they can be produced.
- Move Tier 1 assets into dedicated locations with named access and phishing-resistant MFA.
- Scope and rotate every CI token, deploy key and service account that can read Tier 1 material.
- Exclude Tier 1 stores from unapproved AI tools and block pasting labelled content into public AI services.
- Run DLP in audit mode, tune with owners, then block for Tier 1.
- Retain access and download logs for secret stores long enough to cover the limitation period your counsel advises.
- Add token, key and OAuth revocation plus a recent activity review to the leaver process.
- Review the register and access lists at least annually with legal counsel.
Standards and references
- US Code: 18 U.S.C. 1839, Definitions (Defend Trade Secrets Act)
- US Code: 18 U.S.C. 1836, Civil proceedings
- EUR-Lex: Directive (EU) 2016/943 on the protection of trade secrets
- legislation.gov.uk: The Trade Secrets (Enforcement, etc.) Regulations 2018, regulation 2
- WIPO: Trade Secrets
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Exfiltration Over Web Service
Related NHI Mgmt Group resources: Data Classification Guide · Insider Data Theft Guide · Data Loss Prevention (DLP) Guide · Insider Data Theft Response Playbook. This guide summarises trade secret law as it relates to security controls, as checked on 8 November 2026, and is not legal advice.