CISO and trade secret protection: designing classification and access logs that hold up

How should information classification be designed so that a court accepts it as "reasonable secrecy measures"?

Courts look at whether measures exist, are visible and are enforced. In the court-decision compilation of the Taiwan Intellectual Property Office, drawings without confidentiality marking, NDAs that did not specify their scope and documents without classification have all been reasons for finding that reasonable measures were not taken (courts weigh several shortcomings together).

The design should cover:

• Decide first: check each item against the three elements of Article 2 and decide whether to protect it as a trade secret, by patent or by contract
• Classify and mark: for example three levels (top secret, confidential, internal), with marking on documents and drawings
• Need to know: register the people who may access each item and grant rights by level
• Access records: who accessed or downloaded which item and when
• Before external disclosure: sign a confidentiality agreement that states its scope specifically

What should access logs record, and how long should they be kept to be useful when something happens?

The Trade Secrets Act sets no log retention period. The limitation period gives a frame: under Article 12(2), a damages claim lapses two years after the claimant learns of the act and the person liable, and in any case ten years after the act. Leaks are often discovered some time after an employee leaves; if logs are kept too briefly, the evidence may be gone by then.

• What to record: account, time, which confidential item was accessed or downloaded, device, bulk downloads and transfers out. In Waymo v. Uber, download logs from before the engineer left were key evidence.
• Control reference: ISO/IEC 27001:2022 Annex A 8.15 (logging).
• Who decides: retention, personal data minimisation and storage cost are decided by the CISO and legal on a risk basis; anything that affects litigation strategy is for lawyers.

An employee who is leaving may take data. What should the CISO do first?

1. Suspend and recover: the departure procedure states when accounts are disabled and when devices and documents are returned.
2. Preserve evidence: keep logs, email and related records, with a custody record. The programme can be fixed later; evidence preservation cannot wait.
3. Hand over to lawyers: once data has leaked and a claim is being prepared, call a lawyer first. Litigation, asking prosecutors to issue an investigation confidentiality order, applying for a court confidentiality preservation order, and the final legal opinion belong to lawyers.
4. Rehearse in advance: after rollout, simulate one case of a departing employee taking data, run it from logs to evidence preservation, and fix the gaps.

Post-employment non-compete clauses must separately meet the requirements of Article 9-1 of the Labor Standards Act (at most two years, reasonable compensation and so on) and are handled by HR and legal.

If a new hire brings in a former employer's secrets, can the company be punished too? What can the CISO do?

There is a risk. Article 13-4 of the Trade Secrets Act provides that where an employee or similar staff member commits an offence under Article 13-1 or 13-2 in the course of business, the legal person is fined in addition to the offender; the proviso exempts a legal person that has made every effort to prevent the conduct.

In a Taipei District Court criminal judgment summarised in the Taiwan Intellectual Property Office's Trade Secret Judgment Quarterly (Q4 of ROC year 114), the court considered that the company asked its recruitment agency to tell candidates about confidentiality duties, required new hires to sign a written agreement not to use others' secrets, ran security audits under the ISO 27001 series and trained staff after they joined, and found that the proviso applied, so the company was not fined.

This is one case; whether a company "made every effort" is decided by the court on its size and the facts, so have legal counsel assess it. What the CISO can prepare is onboarding declarations, training and audit records.

Can trade secret classification share ISO 27001 controls? How should the board and ESG reporting cover it?

Yes. The technical side is implemented with ISO/IEC 27001:2022 Annex A 5.12 (classification of information), 5.15 (access control) and 8.15 (logging), sharing documents with ISO 56001; the legal side, such as identifying trade secrets, confidentiality clauses and non-competes, is not covered by 27001.

The TWSE ESG evaluation (which covers listed companies) has two related indicators:

Companies that are not public companies are not covered by the ESG evaluation and can use it voluntarily.

How does Winners Consulting help a CISO with trade secret protection?

• Measures: protection route decided under Article 2; three-level classification, marking, need-to-know registers, access control and logging specifications
• Clauses and response: four confidentiality templates for joining, employment, departure and external parties; a departure and evidence preservation manual, plus one simulated departing-employee case
• Division of work with lawyers: Winners Consulting builds the programme and evidence chain; partner lawyers handle litigation and the final legal opinion
• Timeline (as listed on the service page): four phases, usually 3 to 6 months
• Named clients: MediaTek, MPI Corporation
• Who leads: VP- and director-level consultants lead the work end to end, never outsourced; the first assessment is free

More: Trade secret protection consulting, Choosing a consultant, ISO 27001, CISO role page