What Reasonable Measures Protect a Trade Secret?

When a trade secret case is lost, it is usually lost on reasonable measures. The defendant does not deny that the information was valuable; they show that the company treated it like everything else: no NDA, open network folders, nothing marked, no exit procedure. The statute does not require perfect security. It requires measures that are reasonable under the circumstances, which courts read as proportionate to the value of the information and the size and resources of the business. A ten-person startup is not held to the standard of a defense contractor, but it is held to the standard of a ten-person startup that cared. What follows is the checklist of reasonable measures to protect trade secrets that our trade secret protection team uses when building or auditing a program.

Start with identification

You cannot protect what you have not named. The first measure is an inventory: a written list of the categories of information the company treats as trade secrets, where each lives, who has access, and why it has value. It does not need to describe the secrets themselves. It needs to show that the company made a deliberate decision about what was confidential rather than claiming after the fact that everything was. Courts are skeptical of a plaintiff who identifies the trade secret only once litigation starts, and some require the plaintiff to identify it with particularity before discovery begins. Our post on what qualifies as a trade secret explains the test each item on the inventory must pass.

Contracts with everyone who has access

Confidentiality obligations should bind every person and entity that touches the information:

• Employees sign a confidential information agreement at hiring, before access is granted, with a definition that covers the inventory categories.
• Contractors and consultants sign an agreement with the same scope, plus assignment of anything they develop.
• Vendors, manufacturers, and partners sign an NDA before any sensitive disclosure, with use restrictions as well as non-disclosure.
• Prospective acquirers and investors sign an NDA before diligence, even if they declined one at the pitch.
• Customers who receive technical documentation accept confidentiality terms in the license or master agreement.

The agreements must be drafted well and administered consistently. An NDA that requires confidential documents to be marked, when nothing is ever marked, can undermine the claim rather than support it. The traps are covered in our post on whether an NDA alone protects trade secrets.

Access controls that match the inventory

Restrict access on a need-to-know basis and be able to prove it. Role-based permissions on file systems, code repositories, and databases; multi-factor authentication; logging of who accessed what and when; and separate storage for the most sensitive material. Physical security applies too: locked rooms or cabinets for formulas and prototypes, visitor sign-in, and badges. A court is persuaded by a system that would have shown a leak, not by a policy that says one should exist.

Shared drives are the recurring problem. If every employee can open the folder that holds the pricing model, the pricing model is not being protected. Tiering information so that only the people who need the sensitive layer can reach it is the single most effective and least expensive measure on this list.

Marking and labeling

Label confidential documents, screens, and data exports as confidential or proprietary. Marking is not legally required, but it does two things: it tells the recipient that the material is restricted, which defeats a later claim that they did not know, and it demonstrates to a court that the company was actively managing its secrets. Keep marking proportionate. If everything is marked confidential, including the lunch menu, the label stops meaning anything.

Policies, training, and acknowledgment

Adopt a written confidential information policy and have employees acknowledge it. Train on it at onboarding and periodically after, and keep the attendance records. The policy should cover handling of documents, use of personal devices and personal cloud accounts, remote work, social media, conference presentations, and what to do when a third party asks for information. Our corporate governance and internal policies page describes how these policies fit with the rest of a company’s compliance framework.

Onboarding and offboarding

Departing employees are the most common source of misappropriation, and the offboarding procedure is the measure courts examine most closely. On the last day: revoke all system access, collect company devices, obtain a signed acknowledgment that the employee has returned or deleted all confidential material, remind the employee in writing of their continuing obligations, and, for employees with access to significant secrets, conduct an exit interview that asks where they are going and what they will be doing. Review the employee’s recent activity logs for unusual downloads or transfers. Onboarding has a mirror image: ask new hires to confirm they are not bringing a prior employer’s confidential information with them, which protects the company against being the defendant.

Vendors, cloud services, and third parties

Information shared with vendors and stored in cloud services is still your trade secret if the sharing is controlled. Vendor agreements should restrict use to the engagement, require the vendor to apply its own reasonable measures, and require return or destruction at the end. Cloud storage is not a disclosure, but the account configuration is part of your measures; an open bucket is an open filing cabinet. Our risk management and legal compliance team reviews vendor terms with this in mind.

Documenting your reasonable measures

Every item above produces a record: signed agreements, access logs, training rosters, policy acknowledgments, exit checklists. Keep them. In litigation, the question is not whether the company had good intentions but what it can prove it did. A binder, physical or digital, that shows the program in operation is what turns a reasonable-measures argument from a plausible story into evidence.

If you want an audit of your current practices against this checklist, a consultation with Capitol Law Partners can identify the gaps and the order to close them. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our trade secret protection programs page or schedule a consultation.