Inside job: cybersecurity to protect trade secrets.

• Author: Braithwaite, Jared
• Position: Legal Brief

The threat of outside hackers is not the only reason to implement cybersecurity practices. Thoughtful cybersecurity practices can protect a business's trade secrets from theft by departing employees and competitors.

And while media attention focuses on cybersecurity breaches for large companies, they are not the only targets. A recent survey found that over 50 percent of small and medium-sized businesses had suffered cyberattacks or data breaches in the preceding 12 months. Thus, any business with confidential, valuable information should develop its cybersecurity practices with protection of its trade secrets in mind.

Trade Secrets

Trade secrets can be almost any business information that is valuable because it is secret. This includes information about customers, employees, finances, products, and sales and marketing efforts.

Most states, including Utah, have laws to protect trade secrets through a version of the Uniform Trade Secrets Act. And the federal Defend Trade Secrets Act provides nationwide protection. Under these laws, businesses seeking return or non-disclosure of their trade secrets or to receive damages for improper disclosure must prove that their trade secrets are valuable and subject to "reasonable" protections.

Reasonable Cybersecurity to Protect Trade Secrets

Today most, if not all, business information is stored electronically. The security approach to protect information from hackers is similar to the approach to protect trade secrets. But because trade secrets are often taken by departing employees, there are some additional considerations.

What constitutes "reasonable" protection varies by business and depends on the nature of the trade secrets. So there is no single checklist of protections that is applicable in all situations. Thus, in-house counsel or an outside attorney may be consulted.

Identify Trade Secrets

As an initial matter, it is helpful for a business to understand where its trade secrets are kept and determine what protective measures and retention policies are applicable to them. This identification can also include informing employees about what information the business holds as a trade secret so that employees know what information should be treated with increased confidentiality, which may be accomplished through non-disclosure or confidentiality agreements with employees.

Implement Protective Measures

The next step is to implement protections. Use of computer and network access restrictions...