Knowledge security and economic resilience for entrepreneurs: a quick start guide

Practical guidance on knowledge security and economic resilience 

The importance of knowledge security and economic resilience

Innovative and highly interconnected companies are the beating heart of the economy. However, their unique knowledge and vital partnerships also make them vulnerable to theft, misuse of knowledge, technical failures, espionage and even interference by malicious parties. Knowledge security for companies aims to prevent unwanted transfers of knowledge and technology, safeguard the continuity of production and services, and strengthen autonomy in strategic areas. Companies are economically resilient when they make prevention a top priority and can respond quickly to incidents, limiting damage and getting back up and running as soon as possible.  

A sound approach to knowledge security and economic resilience is not a luxury but a necessity. This applies not only to large and/or high-tech companies and companies operating in strategic sectors, but also to more traditional SMEs and start-ups. Knowledge security is also closely linked to cybersecurity and information security. Learn more on our cybersecurity pages (in Dutch).

Security is a mindset 

Knowledge security goes beyond a checklist of measures covering physical access, the handling of confidential information and vigilance when working with partners. It should be an integral part of your day-to-day business operations. Make knowledge security something that can be discussed openly within your company and team. Foster an open and transparent culture, and make clear what role each employee plays. One extra check can prevent a great deal of trouble.

How do you go about this?

  • Raise awareness of knowledge security in every activity and/or role within the company;
  • Clearly identify who employees can contact with questions;
  • Protect and monitor your intellectual property;
  • Draw up an emergency plan;
  • Provide information, training and coordination, and ensure incidents are handled appropriately. 

Protect your crown jewels: knowledge and intellectual property

Your trade secrets, technical drawings, algorithms, customer and supplier databases, and intellectual property rights such as patents and trademarks are your company’s crown jewels. Keep an inventory of these valuable assets, restrict access to employees who need it, and use non-disclosure agreements. n this context, it can be useful to classify information according to its nature:  

  • Public information: information in the public domain or information that is generally known. This information can be shared freely.
  • Restricted information: information that may only be shared under specific conditions.
  • Confidential information: this may include both technical and commercial data. This information has significant economic value and is critical to your competitive position. This information is not normally not shared.
  • Strictly confidential information: only a few individuals have access to it, and they must act together to access or use it. Think, for example, of recipes such as the Coca-Cola formula.

What else can you do?  

  • Consider IP protection (such as patents, trademarks or design rights), document your creations and ownership and put digital security measures in place (such as encryption, access management and escrow) to prevent disputes, theft or leaks and to respond effectively and resume operations in the event of an incident.  
  • Be prepared for counterfeiting, especially if your business is commercially successful, and make sure you have an initial formal letter ready to assert your rights and demand compliance. Do not let IP trolls, such as copyright trolls, throw you off balance either. Make sure you can recognise them quickly and respond effectively without wasting time or effort.
  • Work with the relevant public authorities to take firm action against online piracy and counterfeiting, as well as malpractice involving your domain name(s), website(s) and/or e-commerce, including cybersquatting and other forms of abuse. For current information on abuse and security, see the DNS website.
  • Appoint someone to be responsible for intellectual property. This ensures that your company protects its valuable knowledge, expertise and information, both technical and commercial. 

Security in collaborations: customers, suppliers and partners 

Businesses are often only as strong as their weakest link. Make clear agreements with customers, suppliers and partners on knowledge security. Check whether they attach the same importance to safeguarding and protecting know-how, commercial data, IT infrastructure and relationships with external parties. Discuss these issues with them openly and transparently.  

Do not be afraid to be critical: a reliable partner will appreciate it. Be alert to the possibility that partners may be lax when it comes to security aspects that matter to you. Carry out some basic checks on a new partner before starting a collaboration (see below). A chain can quickly be broken by a single careless link.

Infrastructure: Security measures

Protect both your digital and physical infrastructure as part of your risk management plan (see below). Restrict physical access and keep an access log for areas where research or production takes place or where sensitive documents are stored. The same goes for electronic access, sharing and storing of data. Make sure employees challenge anyone they do not recognise in the company. Install camera surveillance and alarm systems where necessary. Pay attention to the systems of external parties, so that you can critically assess their level of security.

Managing risks, safeguarding business continuity and handling incidents    

Just as they are for more familiar risks relating to staff, energy, and physical and digital infrastructure, risk management and business continuity plans are essential for knowledge security (including your crown jewels and crucial partnerships, see above). A risk management plan includes an inventory of risks, describing for each risk its likelihood and potential impact. It also sets out the measures to be taken, ranging from accepting or controlling a risk (e.g. through insurance or initial protective measures following an incident) to reducing the risk or terminating a particular partnership or activity. The measures depend on the potential impact of a risk and the likelihood of it occurring. A business continuity plan, in turn, ensures that your company’s essential activities are not, or are only minimally, disrupted by sudden adverse events. Get started with the explanatory notes, accompanying tools and checklists provided by the FPS Economy (in Dutch or French). You can supplement these with advice from external experts if needed.  

Pay particular attention to international operations  

Do you work with international partners or IT providers abroad? Check whether they apply standards that are consistent with those of your company and with your expectations in this area. Try to gather information about a foreign partner (company profile, ownership of company assets (OCA)/ultimate beneficial owner (UBO) check, IP assets, partnerships, etc.) before entering into a collaboration. For critical collaborations involving foreign workers, proof of a clean criminal record, or an equivalent document, can be useful.  

If you work with foreign IT service providers (digital infrastructure, cloud services or software), find out which regulations apply and how they protect data, and check which practices are customary. For instance, a foreign partner or service provider may be required to share information with government authorities. Be alert to countries with less stringent or different privacy or security standards, and assess the reliability of IT partners accordingly. Avoid becoming overly dependent on third parties and apply security by design wherever possible.  

Always exercise caution when travelling to countries with questionable practices or security conditions. Take the necessary precautions before, during and after a business trip:  

  • Before a business trip: install privacy screens, enable screen locks and install antivirus software on your devices. Also bear in mind the practices of local customs and inspection authorities.
  • During a business trip: avoid using public internet connections or public charging facilities, and keep your devices in your hand luggage.  
  • After returning from a business trip: delete any data you no longer need, change any passwords you used while travelling and, if appropriate, have your devices checked by your IT department. 

Risks: hostile states, organised crime, competitors and lax partners

Technology companies, and by extension companies more broadly, are attractive targets for hostile states (espionage and cyberattacks) and organised crime (ransomware and extortion). Competitors may also try to obtain your knowledge or trade secrets. Working with partners (see above) whose security practices are different, lax or non-existent increases your risks. Consider whether the collaborations concerned are strategically important to your company.   

Practical tips

Use the tools, plans and checklists mentioned above to safeguard vital knowledge within your company and in crucial partnerships. Make sure these tools are integrated into your company’s overall security approach, and pay particular attention to aligning them with your IT security measures. Invest in training, conduct regular reviews (of security roles and risk management and business continuity plans, for example), and run exercises to make knowledge security an integral part of your corporate culture. This will help employees recognise and report suspicious activity more quickly.

This guide provides a solid basis for strengthening your company’s economic resilience. Prevention is better than cure, and a healthy degree of caution is essential in a world full of digital and physical risks. 

Useful references