Question 1

Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?

Accepted Answer

The CRO's question on trade secrets is: "if it leaks, will a court find that we took reasonable confidentiality measures?" Article 2 of Taiwan's Trade Secrets Act requires secrecy, economic value and reasonable confidentiality measures at the same time; adding measures after a leak is usually too late. Trade secret protection has no certificate; the measures must exist, be visible and be carried out: information graded and marked confidential, confidentiality agreements that state the scope specifically, a limited circle of people who know with access logs, and confidentiality contracts before external disclosure.

Question 2

Where does a trade secret leak sit on the risk map, and where does the impact come from?

Accepted Answer

Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, a trade secret leak is both an operational and a compliance risk: the loss of core technology, and whether a court will find reasonable confidentiality measures when it leaks. Of the three elements in Article 2 of the Trade Secrets Act, secrecy and economic value depend mainly on the information itself (a company that discloses it loses secrecy); reasonable confidentiality measures are what a company can build most actively, and what is most often disputed in litigation. The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.

Question 3

We have signed confidentiality agreements. Can the CRO rate this risk as controlled?

Accepted Answer

Not enough. A signed confidentiality agreement alone is not enough to amount to reasonable measures. In the TIPO (Intellectual Property Office) casebook, drawings without confidentiality markings, agreements that did not state the scope specifically, and documents without grading have all been reasons courts found reasonable measures were not taken (courts weigh several shortcomings together).
The CRO can test control effectiveness with four checks:
Information is graded and marked confidential
Confidentiality agreements state the scope specifically
The people who know are limited and access is logged
Confidentiality contracts are signed before external disclosure

Question 4

Which records can trade secret KRIs be drawn from?

Accepted Answer

Only visible measures leave records. The grading and evidence design delivered includes a three-level scheme (top secret, confidential, internal), confidentiality marking, a register of people who know, and access control and logging specifications; the leaver process covers return of materials, access revocation and evidence preservation.
The CRO can pick indicators from these records, such as coverage of grading and marking, updates to the register of people who know, completion of leaver procedures and anomalies in access logs, tracked quarterly. On the technical side they map to ISO/IEC 27001:2022 Annex A 5.12, 5.15 and 8.15.

Question 5

How does the CRO verify that the response to a departing employee taking materials actually works?

Accepted Answer

Procedures for return, access revocation and evidence preservation must be set up in advance and exercised once. In the final phase listed on the service page, a departing employee taking materials is simulated from logs to evidence preservation, gaps are fixed, and a maintenance checklist and annual review sheet are delivered.
Once a leak has happened and a lawsuit is being prepared, the first call is to a lawyer; the system can be fixed later, evidence preservation cannot wait. The consultant builds the system and the chain of evidence; litigation, investigation confidentiality orders and the final legal opinion on contracts are for lawyers.

Question 6

How does the intellectual property management plan in ESG indicator S-10 relate to trade secret risk?

Accepted Answer

S-10 (same wording in the 2026 and 2027 editions, A+ item): an intellectual property management plan linked to business goals, its implementation disclosed, and reporting to the board at least once a year. One extra point overall for TIPS (Taiwan Intellectual Property Management System), ISO 56001 or a similar standard with third-party certification. The matching services are trade secret protection and ISO 56001.
Trade secret protection itself has no certificate; the bonus requires third-party certification against a standard such as TIPS or ISO 56001. The ESG evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.

Question 7

How long does it take to build a trade secret protection system?

Accepted Answer

As listed on the service page: depending on company size and the scope of information, four phases usually take 3 to 6 months.
Inventory and identification (2–4 weeks)
System design (4–6 weeks)
Implementation and training (4–8 weeks)
Verification and handover (2–4 weeks): a departing employee taking materials is simulated and gaps are fixed
When ISO 27001 or ISO 56001 is integrated at the same time, the timeline merges into that project.

Question 8

How does Winners Consulting help CROs with trade secret protection?

Accepted Answer

Only measures a court can see: every measure maps to a failure pattern in the casebook or to a statutory element
Law × management × technology: grading, contracts and leaver procedures designed under the Trade Secrets Act; grading, access control and logging implemented through ISO/IEC 27001
Working with lawyers, not replacing them: litigation, applications for investigation confidentiality orders and final legal opinions on contracts come from partner lawyers
Who leads: vice-president and director-level consultants lead end to end, never outsourced
Named clients: MediaTek (trade secret protection consulting); MPI Corporation (ISO 27001 ISMS and trade secret protection consulting)
Trade secret protection programme, Choosing a trade secret consultant, Choosing an ISO 56001 consultant. Request a free mechanism diagnosis