Protection / Companies
Protect the capability, not only the file.
Industrial advantage lives across code, people, process settings, prototypes, suppliers, and customer knowledge. Controls must follow the whole capability.
Operational baseline
- 01
Define the crown jewels
Identify the source code, designs, process parameters, prototypes, supplier knowledge, manufacturing recipes, test data, and tacit know-how that would give a competitor the greatest time or cost advantage.
- 02
Map relationship-to-asset paths
For major customers, suppliers, joint ventures, investors, contractors, visitors, and acquisition targets, document which people and systems they can reach and why that access is necessary.
- 03
Segment and time-bound access
Use least privilege, separate repositories and build systems, restrict bulk export, approve temporary elevation, and remove access promptly when roles or relationships change.
- 04
Join commercial and security signals
Escalate when payment disputes, staff recruitment, requests for deeper technical detail, or product substitution occur alongside unusual downloads, travel, or outside ties.
- 05
Harden sensitive travel
Independently verify invitations; review export and disclosure limits; use minimally provisioned devices; prohibit unnecessary files; and inspect or reimage equipment on return.
- 06
Manage departures lawfully
Use role-based notice, targeted access review, credential changes, device preservation, continuing-duty reminders, and counsel-approved log analysis for staff with high-value access.
- 07
Protect tacit know-how
Document which teams, suppliers, machine settings, troubleshooting practices, and sequences make a process reproducible. Control demonstrations and floor access as carefully as files.
- 08
Prepare proof
Maintain code provenance, reproducible builds, watermarking where appropriate, laboratory notebooks, sample custody, vendor records, and log retention that can support a rapid forensic comparison.
Fair-process guardrails
Risk controls should be specific enough to audit.
Apply the same access, disclosure, travel, and departure rules to equivalent roles. Investigate observed conduct, conflicts, and access—not ethnicity, family origin, or lawful speech. Involve counsel, privacy, HR, security, export, and business owners before combining personnel data or taking adverse action.
This playbook is high-level operational guidance, not legal advice. Employment, monitoring, privacy, export, sanctions, reporting, and preservation duties vary by jurisdiction and circumstance.