Checklist · Intellectual Property

Standing Up a Trade Secret Protection Program: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2025-02-28
Topic
Intellectual Property

A trade secret is the only intellectual property right you earn through conduct rather than a government registration, which makes a protection program the evidence you build in peacetime and hope never to introduce at trial. This checklist walks a company through the five phases of standing up such a program so it satisfies the "reasonable measures" requirement at the center of the Defend Trade Secrets Act, 18 U.S.C. §§ 1836-1839, and the Uniform Trade Secrets Act adopted in every state but New York. It moves from inventorying and classifying confidential information, through building physical, technical, and administrative security layers, to papering relationships with contracts (including the easily-forgotten Section 1833(b) whistleblower-immunity notice), training the workforce, and keeping the whole program alive through audits. Every phase pairs concrete checkboxes with the doctrine that explains why each step matters and the failures that have sunk real trade secret claims. The through-line is proportionality: reasonable measures scale with a company's size and the value of its secrets, so the goal is demonstrable, documented, defensible effort rather than the impossible ideal of perfect security. Read alongside UpLaw's companion resources on the underlying doctrine, drafting, departures, and audits.

Standing Up a Trade Secret Protection Program: A Practical Checklist

Intellectual Property > Trade Secret | Published 28 February 2025 - Updated 16 July 2025 | UpLaw - uplaw.us

Trade secret protection is the one intellectual property right you cannot buy at a government window. There is no certificate to wave at a judge, no registration number, no examiner's seal. What you have instead is a record of your own behavior — and a protection program is the disciplined manufacture of that record before anyone tries to walk out the door with the goods.

Keywords: trade secret protection program, reasonable measures, DTSA, Uniform Trade Secrets Act, confidential information inventory, access controls, least privilege, confidentiality agreement, invention assignment, Section 1833(b) notice, employee training, departing employees, classification, non-compete, Economic Espionage Act, ex parte seizure

Patents and registered trademarks arrive with paper. A trade secret arrives with nothing but your conduct. Under the Defend Trade Secrets Act (DTSA), 18 U.S.C. § 1839(3), and the Uniform Trade Secrets Act (UTSA) — adopted in some form in every state except New York, which protects secrets through common law — information qualifies for protection only if it both (1) "derives independent economic value . . . from not being generally known" and (2) "is the subject of efforts that are reasonable under the circumstances to maintain its secrecy." The first element is about the information. The second is about you. And because the second element rides entirely on what the owner did, a protection program is, at bottom, evidence you assemble in advance and hope you never have to introduce.

This checklist explains how to build that evidence. It is written so a founder, an in-house lawyer, a line manager, and a skeptical trial judge can all follow it. For the doctrine underneath every step here, read it against UpLaw's overview of how secrecy becomes protectable intellectual property and the narrative companion on building trade secret protection from the ground up. For the audit discipline that keeps a program honest, see auditing your trade secrets. For the full life cycle from identification through litigation, the trade secret protection toolkit collects the resources in one place.

One principle governs everything below. "Reasonable under the circumstances" is a sliding scale, not a fixed bar. A four-person hardware startup is not measured against a defense contractor's security operations center. Judge Posner put the economics plainly in Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174, 179-80 (7th Cir. 1991): perfect security is neither possible nor optimal, because the cost of the last increment of protection can exceed the value of the secret it guards, so the law asks only for measures that are sensible given the stakes. The goal is not a fortress. It is demonstrable, proportionate effort that a court will recognize as reasonable.

The Legal Engine: Why "Reasonable Measures" Is the Whole Ballgame

Before the checkboxes, it helps to see what all of them are for. Three statutes and one body of common law define the field.

The DTSA, enacted May 11, 2016 as an amendment to the Economic Espionage Act, created a federal civil cause of action for trade secret misappropriation. Pub. L. No. 114-153, 130 Stat. 376, codified at 18 U.S.C. §§ 1836-1839. It supplies the private right of action (§ 1836(b)), the definition of a trade secret and its "reasonable measures" requirement (§ 1839(3)), whistleblower immunity and the notice obligation that comes with it (§ 1833(b)), an extraordinary ex parte seizure remedy (§ 1836(b)(2)), the remedies menu (§ 1836(b)(3)), and a three-year limitations period running from discovery (§ 1836(d)).

The UTSA is the state-law twin, adopted in 49 states, the District of Columbia, and several territories. Its definition (§ 1(4)) is materially the same as the DTSA's, and courts read the two in tandem; the DTSA was, in the drafters' words, "largely modeled" on the UTSA. Because the DTSA did not preempt state law, most plaintiffs plead both. New York, the lone holdout, protects trade secrets through the multi-factor common-law test drawn from the Restatement (First) of Torts § 757 cmt. b.

The Economic Espionage Act (EEA), 18 U.S.C. §§ 1831-1832, is the criminal track. Section 1832 punishes ordinary theft of trade secrets with up to ten years' imprisonment and, for organizations, fines up to the greater of $5 million or three times the value of the stolen secret including avoided development costs. Section 1831 punishes theft that benefits a foreign government or instrumentality with up to fifteen years and organizational fines up to the greater of $10 million or three times value. UpLaw's guide to the real cost of IP piracy maps how the civil and criminal tracks interact.

Behind all three sits the constitutional backdrop the Supreme Court supplied in Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1001-04 (1984): a trade secret is a property interest, protectable under the Takings Clause, but a fragile one that "may be destroyed" the moment secrecy is lost. And Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974), confirmed that trade secret law lawfully coexists with the federal patent system, which is why a company gets to choose secrecy over disclosure in the first place. The two regimes do genuinely different work; UpLaw's side-by-side comparison of the four IP regimes lays out when secrecy is the right instrument and when it is not.

Now the point that makes every phase below matter. In litigation, the plaintiff must prove it took reasonable measures, and courts have shown they will bracket the spectrum without much sympathy. On the losing end sits Abrasic 90 Inc. v. Weldcote Metals, Inc., 364 F. Supp. 3d 888 (N.D. Ill. 2019), where the plaintiff was denied a preliminary injunction because it had done "virtually nothing" — no confidentiality agreements with the relevant employees, no meaningful access restrictions, no policy worth the name. Nearby sits Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018), a case that should frighten any company that assumes technology equals protection: the employer had a password-protected network and still failed the reasonable-measures test, because it affirmatively encouraged an executive to keep customer information on his personal phone and laptop, never marked the information confidential, and never obtained a confidentiality agreement covering it. The lesson repeated across these cases is unglamorous. What separates the winners from the losers is rarely the intrinsic value of the information. It is the paperwork, the access discipline, and the ability to show a court a program that actually operated.

The six factors courts actually weigh

"Reasonable under the circumstances" is a standard, not a rule, and courts populate it with a familiar set of factors inherited from the common law. The Restatement (First) of Torts § 757 cmt. b — still cited constantly, and the governing framework in New York — lists six: (1) the extent to which the information is known outside the business; (2) the extent to which it is known by employees and others inside the business; (3) the measures taken to guard its secrecy; (4) the value of the information to the business and its competitors; (5) the effort or money expended in developing it; and (6) the ease or difficulty with which others could properly acquire or duplicate it. The Restatement (Third) of Unfair Competition §§ 39-45 refines the modern analysis, but the intuition is unchanged: courts triangulate secrecy, value, and effort. A protection program is, in effect, a machine for generating favorable facts on factors (2) and (3) — how tightly access is held and what was done to guard it — because those are the factors a defendant will attack and the ones most within the owner's control. Keep that in view as you read the phases: each checkbox is a fact you are creating for a future factor-three analysis.

Secret or patent? The threshold choice that shapes the program

Before pouring resources into secrecy, decide whether secrecy is even the right instrument, because Kewanee lets you choose but the choice is often one-way. A patent trades disclosure for a time-limited monopoly and, critically, defeats a competitor's independent invention or reverse engineering — two things trade secret law expressly permits. Reverse engineering is lawful proper means under the UTSA and the DTSA (18 U.S.C. § 1839(6)(B)), so a secret embodied in a product sold to the public — a mechanism a rival can take apart and measure — is fragile in a way a patented one is not. Secrecy shines for information that cannot be reverse engineered from a shipped product (a manufacturing process, a source-code back end, a negative result, internal business data) and for information with a long useful life that would outlast a 20-year patent term, the classic example being the Coca-Cola formula. It is the wrong tool for a self-revealing invention that a competitor can independently reach. Many companies run both regimes in parallel — patenting the parts that ship and can be measured, keeping secret the process and data that never leave the plant. UpLaw's guide to how the law protects software works through that allocation for code, and the four-regime comparison maps the trade-offs across IP types. Get this decision right first; the program you build in the next five phases is only worth building for the information that belongs on the secrecy side of the line.

Phase 1: Identify and Inventory What You Actually Have

You cannot protect — or later describe to a court — what you have never catalogued. The inventory is the foundational document of the entire program, and it does double duty: it drives your security decisions today, and it is the record that lets you later identify your secrets "with sufficient particularity" without disclosing them further in a public filing.

Convene the people who know where the secrets live

  • [ ] Assemble a small cross-functional team drawn from R&D, engineering, product, sales operations, finance, and IT. No single department knows the whole portfolio; the algorithm lives with engineering, the margin structure with finance, the curated account intelligence with sales.
  • [ ] Give the effort an owner — usually in-house counsel or a designated trade secret coordinator — who is accountable for maintaining the inventory over time.
  • [ ] Treat the inventory itself as confidential. A comprehensive map of your crown jewels is a crown jewel.

Ask the three diagnostic questions

For each candidate secret, run it through a simple screen:

  • [ ] What would help a competitor? If a rival would pay for it, plan around it, or accelerate because of it, it has competitive value.
  • [ ] What did we invest heavily to develop? Time, money, failed iterations, and specialized talent are proxies for the "independent economic value" element.
  • [ ] What would be costly or slow for an outsider to recreate? The harder the re-creation, the stronger the secret — because value flows from the gap between what you know and what the market knows.

Catalog both kinds of secret — including the negative kind

  • [ ] Inventory technical secrets: formulas, manufacturing processes and parameters, source code and architecture, algorithms, training data and model weights, tooling designs, chemical compositions, and test results.
  • [ ] Inventory business secrets: curated customer lists carrying non-public preferences and buying patterns, pricing and cost structures, margin data, supplier terms, unannounced product roadmaps, M&A plans, and marketing strategy.
  • [ ] Do not overlook negative know-how — the approaches you tried that failed. The knowledge that a given catalyst poisons the reaction, or that a particular architecture cannot scale, has real value precisely because it spares a competitor the same dead ends. Courts have long recognized that negative information qualifies; the DTSA's definition expressly reaches secrets "whether tangible or intangible."

Record the metadata that turns an item into evidence

  • [ ] For each item, capture: what it is (described specifically enough to be identifiable, generally enough not to expose it); where it lives, both physically and electronically; who currently has access; why it has economic value; and what agreements or policies already govern it.
  • [ ] Add a value note for each crown jewel — for example, "~18 person-months and roughly $1.4M to develop; sustains an estimated 12% price premium over the nearest substitute." This single line does two jobs: it documents the "independent economic value" element the statute requires, and it seeds the damages theory you would eventually put to a jury. UpLaw's guide to what an IP case is worth explains how those early value notes mature into reasonable-royalty and unjust-enrichment models.

Exclude what is not actually a secret

  • [ ] Affirmatively exclude information that is generally known, readily ascertainable from public sources, or simply not valuable. Over-claiming is not merely useless; it is affirmatively harmful.

Why this matters. Two doctrines punish the company that treats "everything" as secret. First, when a company claims that all of its information is confidential, a court may conclude that it treated none of it as genuinely secret — the reasonable-measures inquiry turns on differentiation, and a policy that protects everything protects nothing. Second, federal pleading standards require specificity. A plaintiff who gestures at "all confidential business information" invites dismissal under Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), and Ashcroft v. Iqbal, 556 U.S. 662 (2009), and courts have refused to let vague, sprawling secrecy claims proceed. In IDX Systems Corp. v. Epic Systems Corp., 285 F.3d 581, 583-84 (7th Cir. 2002), a 43-page description that never separated the secret from the general software was held too indefinite to support the claim. Several states go further and require a plaintiff to identify its trade secrets with "reasonable particularity" before it may take discovery — California codifies the rule at Cal. Civ. Proc. Code § 2019.210. A clean, specific inventory built in peacetime is what lets you meet these demands without a scramble.

Customer lists deserve their own caution. A roster anyone could reconstruct from a trade directory is not a secret. A compilation that took years of effort and expense, and that carries non-public intelligence conferring value over the raw public data, can be — AirFacts, Inc. v. de Amezaga, 909 F.3d 84, 96 (4th Cir. 2018). The difference lives in the details you record now.

Worked example. Suppose a hypothetical specialty roaster, Cindermill Coffee Roasters, believes its "secret sauce" is its whole business. Its inventory team, forced to be specific, finds three genuine crown jewels: a proprietary roast-curve profile (temperature and airflow over time) that a competitor could not derive by tasting the beans; a green-coffee sourcing model that predicts crop quality from weather and soil data; and a compiled account file for its 40 largest wholesale buyers, annotated with each buyer's contract renewal dates and private flavor preferences. It also finds that its "secret" espresso blend ratio is printed on a bag insert sold to the public — not a secret at all — and that its equipment list is a matter of public procurement records. By separating the two categories, Cindermill both strengthens the three real secrets and avoids the over-claiming trap that would let a defendant argue it never distinguished the confidential from the ordinary.

Common mistakes. Skipping the inventory because "everyone knows what's sensitive"; claiming everything is a secret; letting the inventory go stale so it points forensic investigators at the wrong systems after a departure; and failing to note value, which leaves you proving the "independent economic value" element from scratch years later.

Phase 2: Build the Three Layers of Security

Reasonable measures are conventionally organized into three layers — physical, technical, and administrative. No single layer is sufficient; each compensates for the gaps in the others. A locked lab means little if the schematics leave nightly on a personal cloud drive, and the strictest access-control list means little if the door to the prototype room is propped open for the HVAC contractor.

Physical security

  • [ ] Control physical access to labs, prototype areas, server rooms, and any space where a secret process is performed. Log and escort visitors; require badges; keep an access record.
  • [ ] Adopt clean-desk practices, locked storage for sensitive documents, and shredding rather than discarding. A recovered draft in a dumpster has ended more than one secrecy claim.
  • [ ] Mark tangible embodiments of secrets conspicuously — "CONFIDENTIAL" or "TRADE SECRET." Marking is cheap and, as Yellowfin shows, its absence is often fatal.
  • [ ] On a factory floor, compartmentalize a visible process so that no single person sees the whole, and route plant tours and vendor visits away from sensitive operations.
  • [ ] Before deploying biometric access controls such as fingerprint or retina scanners, confirm compliance with state biometric-privacy statutes. Illinois's Biometric Information Privacy Act (BIPA) imposes notice-and-consent duties and a private right of action with statutory damages; other states, including Texas and Washington, have their own regimes. UpLaw's survey of biometric privacy law explains why a security upgrade can create a separate compliance liability if rolled out carelessly.

Technical security

  • [ ] Apply the principle of least privilege: restrict access to crown-jewel repositories to the specific individuals who actually need it, not the entire engineering org. Every additional holder is a new point of failure and a new witness you would rather not need.
  • [ ] Require authentication — ideally multifactor — and enable access logging that records who touched what and when. In the typical departure case, these logs are the single most persuasive piece of evidence, because they convert suspicion into a timeline of bulk downloads on the eve of resignation.
  • [ ] Encrypt data at rest and in transit; enforce full-disk encryption on every device that touches a secret.
  • [ ] Deploy network segmentation, firewalls, and data-loss-prevention (DLP) tooling that flags or blocks confidential files emailed to outside addresses or copied to removable media.
  • [ ] Disable USB ports on machines that touch the most sensitive repositories where operationally feasible.
  • [ ] Reclaim company data from personal devices, and do not leave valuable information on hardware you do not control. The mirror image of Yellowfin is the company that permits — or worse, encourages — storage on personal phones and laptops and then cannot show a court it did anything to keep the information in.
  • [ ] Remember that unauthorized access to your systems can itself be a federal offense under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, though after Van Buren v. United States, 141 S. Ct. 1648 (2021), the statute's "exceeds authorized access" clause reaches only those who access areas of a system placed off-limits, not those who misuse data they were entitled to see. UpLaw's analysis of the CFAA after hiQ v. LinkedIn traces where access control ends and mere misuse begins.

Administrative security

  • [ ] Adopt a written trade secret and confidential-information policy that defines what counts as confidential, sets classification levels, specifies handling rules, and states the consequences of violation. The written policy is both a control and a piece of evidence.
  • [ ] Implement a tiered classification system — for example, public / internal / confidential / restricted — with distinct rules for handling, storage, transmission, and disposal at each tier. Classification is what lets you show a court you treated the crown jewels differently from the cafeteria menu.
  • [ ] Enforce the need-to-know principle so that each additional person with access is a deliberate, recorded decision rather than an accident of an over-broad permission group.
  • [ ] Confine confidentiality policies to genuine proprietary business, customer, and vendor information, and include an NLRA savings clause so the policy does not sweep in — and thereby chill — employees' Section 7 rights to discuss wages and working conditions. The National Labor Relations Board has invalidated overbroad confidentiality rules, and a policy struck down as unlawful is worth little as evidence of reasonable measures. UpLaw's guide to building a legally sound employee handbook covers how to draw that line.

Why this matters. Return to the bracket. Abrasic 90 lost because it built almost no layer at all. Yellowfin lost despite a technical layer because it neglected the administrative one — no marking, no agreement, and an affirmative invitation to store data on personal devices. The pattern that wins is not the most expensive security. It is a coherent set of measures across all three layers, sized to the secret, and documented well enough that a witness can describe it and a log can corroborate it. When those layers are stress-tested by an actual intrusion, they also become the backbone of an incident response; UpLaw's checklist on when a breach hits your crown jewels and its companion on building IP into incident response explain how to preserve reasonable-measures status in the middle of a crisis.

Worked example. Return to Cindermill. Its roast-curve profile lives in a single controlled application, accessible to four people, each authenticated with MFA, with every read logged. The file is encrypted, labeled "RESTRICTED — TRADE SECRET," and cannot be exported to USB. The sourcing model sits one tier down, "CONFIDENTIAL," available to the eight-person sourcing team. The annotated account file is "CONFIDENTIAL," accessible to sales leadership and flagged by DLP if attached to an outbound email. When a sourcing analyst later resigns to join a rival, the logs show she pulled the entire model to a personal Dropbox two days before giving notice. That single timeline, made possible by peacetime discipline, transforms a hunch into a case.

Phase 3: Layer Contracts on Top of the Statutes

Statutes protect secrets by default, but contracts do two things the statutes alone cannot. They reach information that may fall short of the strict statutory definition — the merely confidential, the not-quite-valuable-enough — and they themselves count as evidence that the company took reasonable measures. A signed agreement is a control and an exhibit at once.

Confidentiality agreements

  • [ ] Have every employee sign a confidentiality agreement at the start of employment, before any secrets are disclosed. The employment relationship itself supplies the consideration, so first-day execution is both the cleanest legal posture and the strongest evidentiary one.
  • [ ] For agreements rolled out mid-employment, pair them with genuine, documented new consideration — a bonus, raise, promotion, or equity grant — because in some states continued at-will employment alone is thin or insufficient consideration for a new restrictive covenant.
  • [ ] Draft the confidential-information definition carefully: broad enough to cover the portfolio, specific enough to be enforceable, and paired with the standard exclusions (information that becomes public through no fault of the recipient, was already known, or is independently developed). UpLaw's clause-by-clause NDA checklist and its guide to drafting NDAs for technology deals walk through the choices that decide enforceability.

Invention assignment agreements

  • [ ] Have every employee and contractor sign an invention assignment agreement using present-tense, self-executing language — "hereby assigns" — rather than a mere promise to assign in the future. The distinction is not pedantic. In Board of Trustees of the Leland Stanford Junior University v. Roche Molecular Systems, Inc., 563 U.S. 776 (2011), a promise to assign lost a priority contest to a competing agreement that assigned in the present tense, and the university lost its patent rights.
  • [ ] Respect state carve-outs for inventions an employee develops entirely on their own time without company resources. California codifies the carve-out at Cal. Lab. Code § 2870, and Washington, Illinois, Minnesota, and others have parallel statutes; a well-drafted agreement acknowledges them rather than overreaching. UpLaw's guide to employee invention assignment agreements across jurisdictions collects the state variations and the holdover-clause traps.

The Section 1833(b) whistleblower-immunity notice

  • [ ] Include the DTSA Section 1833(b) whistleblower-immunity notice in every agreement — employee and contractor — that governs the use of a trade secret or other confidential information, if entered into or amended after May 11, 2016. You may satisfy the requirement by cross-referencing a policy document that contains the notice, but for contractors who never see internal policies, put the notice in the contract itself.

Why this matters. The notice is the single cheapest piece of insurance in trade secret law, and forgetting it is a self-inflicted wound. Section 1833(b)(1)-(2) grants immunity to whistleblowers who disclose a trade secret in confidence to a government official or attorney solely to report or investigate a suspected violation of law, or in a sealed court filing. In exchange, § 1833(b)(3) requires employers to give notice of that immunity in relevant agreements. The penalty for omission is specific and expensive: an employer that fails to provide the notice "may not be awarded exemplary damages or attorney fees under subparagraph (B) or (C) of subsection 1836(3)" in a DTSA action against an employee who never received it. 18 U.S.C. § 1833(b)(3)(C); see Xoran Holdings LLC v. Luick, 2017 WL 4039178, at *7 (E.D. Mich. Sept. 13, 2017). You keep your state-law claims and your compensatory damages, but you forfeit the two remedies that most sharpen a DTSA case. A single paragraph, dropped into the offer-letter template, protects both.

Third-party and vendor confidentiality

  • [ ] Bind third parties — customers, suppliers, joint-venture partners, prospective acquirers — with confidentiality terms before sharing anything. Use mutual NDAs where both sides disclose.
  • [ ] Track every disclosure and the agreement that governs it, so you can prove that no secret ever left the building naked.

Why this matters. Sharing a secret with an outsider who is under no obligation of confidence can extinguish it outright, because the information is no longer the subject of reasonable secrecy efforts. In Farmers' Edge Inc. v. Farmobile, LLC, 970 F.3d 1027 (8th Cir. 2020), the claimed secrets had been disclosed to third parties without adequate confidentiality protection, and the claim failed. The flip side is reassuring: limited, controlled disclosure to those who need to know, under confidentiality obligations, does not destroy a secret. Metallurgical Industries Inc. v. Fourtek, Inc., 790 F.2d 1195, 1200 (5th Cir. 1986), holds that a plaintiff can share a secret with a handful of vendors and licensees under confidentiality and still keep it. The rule is not "never share." It is "never share without a wrapper."

Special disclosures: licensing, diligence, and the government

Three recurring situations deserve their own protocol, because each puts secrets in front of outsiders for a legitimate business reason and each has its own failure mode.

  • [ ] Licensing. When you license a secret — a formula, a process, source code — the license is both a revenue instrument and a secrecy measure. It must impose use restrictions, confidentiality obligations that survive termination, audit rights, and a duty to return or destroy materials at the end of the term. A poorly drafted license that lets a licensee exploit the secret beyond the grant, or that lacks survival, can leak value permanently.
  • [ ] M&A and financing diligence. A buyer or investor will want to inspect the crown jewels. Stage disclosures behind an NDA, use a controlled data room with logging and watermarking, disclose in tiers (sensitive material only at signing or in a clean team), and never dump raw secrets into an open room early in a process that may collapse. On the sell side, the inventory you built in Phase 1 is exactly what a sophisticated buyer will ask to see; UpLaw's guide to getting diligence-ready before you raise and the IP transactions toolkit cover how to present it without over-exposing it.
  • [ ] Government submissions and public filings. Information handed to a regulator, submitted with a bid, or filed with a court can lose its secrecy unless you invoke the available protections — confidential-treatment requests, protective orders, and sealing. The DTSA itself lets a party protect a secret's confidentiality in litigation (18 U.S.C. § 1835(b)), and the Supreme Court's reading of FOIA Exemption 4 in Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356 (2019), protects commercial information that is customarily kept private and submitted under an assurance of confidentiality. Redact filings; when depositing source code for copyright registration, use the Copyright Office's trade-secret redaction options rather than exposing the whole program, as covered in UpLaw's software copyright registration checklist.

Non-competes as a fragile supplement — never the foundation

  • [ ] Treat non-compete covenants as a state-law-dependent supplement, and build the secrecy program on access controls, confidentiality agreements, and enforcement instead.
  • [ ] Prefer non-solicitation covenants — of customers and of employees — which survive even in jurisdictions hostile to non-competes, along with garden-leave arrangements where appropriate.

Why this matters. The regulatory ground here has shifted hard. The Federal Trade Commission's 2024 rule purporting to ban most non-competes nationwide was set aside by a federal court in Ryan, LLC v. FTC, No. 3:24-CV-00986-E (N.D. Tex. Aug. 20, 2024), and never took effect; non-compete enforceability is now governed entirely by widely varying state law. California, Minnesota, North Dakota, and Oklahoma broadly void employee non-competes; other states enforce them only if reasonable in scope, duration, and geography and supported by adequate consideration. Building a secrecy strategy on a non-compete is building on sand that shifts by state line and by legislative session. UpLaw's analysis of the future of non-competes and the state-law patchwork tracks the developments; the durable move is to make the trade secret program itself — not the covenant — do the work.

Worked example. Cindermill hires a plant engineer away from a competitor. On day one, before touching the roast-curve application, the engineer signs a confidentiality agreement (with the § 1833(b) notice), a present-tense invention assignment acknowledging the California carve-out, and a customer non-solicitation covenant. Cindermill deliberately declines to demand a non-compete, both because it operates in California — where the covenant would be void — and because it would rather have enforceable, portable protections than an unenforceable one that signals overreach to a court.

Phase 4: Make the People the Strongest Layer

Most trade secrets do not leak through a firewall. They walk out in someone's memory, on someone's laptop, or in someone's willingness to email "just a few files" to a personal account. The workforce is therefore the layer that matters most — and the layer courts most often ask about when they assess reasonableness.

Onboarding training and acknowledgment

  • [ ] Train every new hire on what trade secrets are, your specific policies, how to recognize and handle confidential information at each classification tier, and the consequences of violation. Capture a signed acknowledgment of the training and the policy.
  • [ ] Make the acknowledgment specific enough to be evidence: it should reference the actual policy version and confirm the employee's understanding of their obligations.

Role-specific training

  • [ ] Deliver role-tailored training rather than one generic module. Give R&D and engineering depth on technical secrets and the risk of inadvertent disclosure through publications, conference talks, or open-source contributions. Give sales guidance on the permissible use of customer information and the line between general skill and protected compilation. Give IT security-specific training on access controls and logging.

Handling inbound hires from competitors

  • [ ] When hiring from a competitor, ask candidates in writing to identify any confidentiality, invention-assignment, or non-compete agreements they signed with prior employers, and to confirm they will not bring, use, or disclose any former employer's confidential materials.
  • [ ] Instruct new hires, in writing, not to bring any prior-employer documents, files, or devices, and to certify they have none. Retain the certification.

Why this matters. Careless hiring does not just create a defense problem; it can make you a defendant. If a new engineer arrives carrying a competitor's source code, your company can be dragged into a misappropriation suit for using it. The Apple Inc. v. Rivos litigation illustrates how a documented, written instruction not to import a prior employer's secrets — and evidence the company acted on it — can be close to case-dispositive in showing clean hands. The written instruction is cheap; the trial that follows its absence is not. UpLaw's checklist for protecting trade secrets when employees leave covers the mirror-image discipline on the offboarding side, where continuing-obligations reminders and access revocation do the same evidentiary work.

Build a culture, not just a binder

  • [ ] Signal from leadership that protecting confidential information is part of everyone's job, and enforce the policy consistently. Selective enforcement is worse than none, because it lets a departing employee argue the rules were theater.

Worked example. Cindermill's onboarding includes a 30-minute trade secret module and a signed acknowledgment. Its head roaster attends a role-specific session on why a conference slide revealing the airflow schedule would be a public disclosure that destroys the secret. When a sales manager later joins from a competitor, HR collects a signed certification that she brought no prior-employer files, and IT confirms her new laptop is clean. Two years on, when the competitor accuses Cindermill of poaching its methods, that paper trail lets Cindermill show a court exactly what it did to keep the competitor's secrets out — and its own in.

Phase 5: Keep the Program Alive

A protection program is a living system, not a one-time project. "Reasonable under the circumstances" is a moving target, and a policy honored only on paper is worse than none — it advertises the gap between what you claimed and what you did.

  • [ ] Run a trade secret audit at least annually, and after any major change — a fundraise, an acquisition, a pivot, a shift to remote work, a new product line, or a reorganization that scrambles access. UpLaw's audit checklist provides the workflow.
  • [ ] Keep the inventory a living document: add newly created secrets, retire information that has been disclosed or gone obsolete, and update access lists as people change roles and leave. A stale inventory misdirects investigators after a breach and undercuts the specificity you need to plead a claim.
  • [ ] Track changes in law (non-compete developments, NLRB guidance on confidentiality rules, new biometric and privacy statutes), in technology (new collaboration platforms, generative-AI tools that ingest confidential prompts, personal-device patterns), and in peer practice.
  • [ ] Benchmark against what competitors and courts currently treat as reasonable, and adjust. What sufficed for a garage startup will not satisfy a court once the company has raised a Series B and can plainly afford access logging and DLP.

Why this matters. The remote-work and cloud dimension has become central. When employees work from home on personal networks, sync files to consumer cloud accounts, and collaborate across a dozen SaaS tools, the classic perimeter dissolves and reasonable measures must be re-expressed as identity, access, and endpoint controls. UpLaw's analysis of guarding trade secrets without a perimeter translates the case law into concrete controls for distributed teams. If your company also handles personal data, the trade secret program should be built alongside — and can borrow governance machinery from — a privacy program; see UpLaw's parallel checklist on standing up a privacy compliance program, which uses the same inventory-classify-control-audit rhythm.

When It Goes Wrong: Litigating From a Position of Strength

The point of Phases 1 through 5 is to make Phase 6 — enforcement — winnable. Everything you built in peacetime becomes evidence and remedy the day a secret walks.

The evidence you already built

  • [ ] Preserve and pull the access logs. In the modern misappropriation case, the plaintiff's best exhibit is rarely a smoking-gun email; it is a system log showing a departing employee downloading gigabytes to a personal drive, or deleting files to cover the trail, in the final days of employment. This is why Phase 2's logging discipline matters more than any single control.
  • [ ] Move quickly to preserve devices and issue litigation holds. Forensic timing evidence degrades and disappears.

The DTSA remedies menu

  • [ ] Injunctive relief to stop actual or threatened misappropriation, and to protect against future use (§ 1836(b)(3)(A)).
  • [ ] Compensatory damages measured by actual loss and unjust enrichment, or in the alternative a reasonable royalty for the unauthorized use (§ 1836(b)(3)(B)).
  • [ ] Exemplary damages up to two times the compensatory award, and attorney's fees, where the misappropriation was willful and malicious (§ 1836(b)(3)(C)-(D)) — but recall that omitting the § 1833(b) notice forfeits both against an uninformed employee.
  • [ ] In extraordinary cases, an ex parte civil seizure of property to prevent propagation or dissemination of the secret (§ 1836(b)(2)) — a powerful, tightly cabined remedy available only when the statute's demanding conditions are met, and one courts guard against abuse. UpLaw's practitioner guide to ex parte remedies in IP litigation walks through the seizure mechanics and their limits.

A caution on inevitable disclosure

  • [ ] Do not build your departure strategy on the inevitable-disclosure doctrine. First recognized in PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995), it allows an injunction where a former employee's new role makes it inevitable that they will rely on the old employer's secrets — but its acceptance varies sharply by state, and jurisdictions such as California reject it outright as a backdoor non-compete. Where recognized, courts have entertained it under the DTSA as a species of threatened misappropriation, but it is a fragile foundation. Documentary proof — access logs, bulk downloads, deletions — is far more durable than a theory a court may refuse to apply.

Remember the criminal and cross-border tracks

  • [ ] Serious theft, especially by a departing insider or a foreign actor, may warrant a referral under the EEA (§§ 1831-1832). And know that improper means has a boundary: reverse engineering and independent development are lawful, so the strongest protection against a competitor's clean-room derivation is often secrecy plus, where the invention qualifies, a patent. UpLaw's guide to how the law protects software explains when to keep a secret and when to file.
  • [ ] Watch the clock. The DTSA imposes a three-year limitations period running from when the misappropriation was discovered or should have been discovered by reasonable diligence (§ 1836(d)); state UTSA periods are comparable but not identical.

Program-Wide Mistakes to Avoid

  • Treating protection as a one-time project rather than a continuous program that is audited, updated, and enforced.
  • Relying on a non-compete as the secrecy plan instead of on access controls, contracts, training, and enforcement — a bet that gets worse every time a state legislature acts.
  • Forgetting the Section 1833(b) notice in offer letters and, especially, in contractor agreements, and thereby forfeiting exemplary damages and fees.
  • Letting valuable information live on unmanaged personal devices and cloud accounts, and never reclaiming it — the Yellowfin error.
  • Over-claiming secrecy across the whole enterprise, which lets a defendant argue nothing was ever treated as truly secret and undermines the specificity a court demands.
  • Building a departure strategy on inevitable disclosure rather than on the documentary proof your own systems generate.
  • Failing to paper third-party disclosures, which can extinguish a secret the moment it leaves the building unprotected.

Primary and Secondary Authority

Statutes. Defend Trade Secrets Act of 2016, Pub. L. No. 114-153, 130 Stat. 376, codified at 18 U.S.C. §§ 1836-1839 — civil cause of action (§ 1836(b)); definition and reasonable measures (§ 1839(3)); misappropriation and improper means (§ 1839(5)-(6)); whistleblower immunity and notice (§ 1833(b)); ex parte seizure (§ 1836(b)(2)); remedies (§ 1836(b)(3)); limitations (§ 1836(d)). Uniform Trade Secrets Act §§ 1-5 (adopted in every state except New York). Economic Espionage Act, 18 U.S.C. §§ 1831-1832 (criminal track). Computer Fraud and Abuse Act, 18 U.S.C. § 1030. California invention-assignment carve-out, Cal. Lab. Code § 2870; California trade-secret identification rule, Cal. Civ. Proc. Code § 2019.210. Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq.

Cases. Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974); Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984); Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991); PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995); Metallurgical Industries Inc. v. Fourtek, Inc., 790 F.2d 1195 (5th Cir. 1986); IDX Systems Corp. v. Epic Systems Corp., 285 F.3d 581 (7th Cir. 2002); Board of Trustees of the Leland Stanford Junior University v. Roche Molecular Systems, Inc., 563 U.S. 776 (2011); Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018); Abrasic 90 Inc. v. Weldcote Metals, Inc., 364 F. Supp. 3d 888 (N.D. Ill. 2019); Farmers' Edge Inc. v. Farmobile, LLC, 970 F.3d 1027 (8th Cir. 2020); AirFacts, Inc. v. de Amezaga, 909 F.3d 84 (4th Cir. 2018); Xoran Holdings LLC v. Luick, 2017 WL 4039178 (E.D. Mich. Sept. 13, 2017); Van Buren v. United States, 141 S. Ct. 1648 (2021); Ryan, LLC v. FTC, No. 3:24-CV-00986-E (N.D. Tex. Aug. 20, 2024); Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007); Ashcroft v. Iqbal, 556 U.S. 662 (2009).

Secondary. Restatement (First) of Torts § 757 cmt. b; Restatement (Third) of Unfair Competition §§ 39-45.

Related UpLaw Resources

Related Guides

Related Checklists

Related Articles

Related Toolkits

This checklist is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Trade secret and employment law vary by jurisdiction and continue to evolve. Consult qualified counsel about your specific circumstances before acting.