Trade Secret Protection and Departure Checklist: Inventory, Controls, and Exit Forensics

By Casey Scott McKay · 2026-03-15

This is the working document for the two jobs a trade secret program has to do: build the record before anything goes wrong, and execute cleanly in the seventy-two hours after someone resigns. It runs eleven phases, from the inventory interview that produces a dated register through classification and marking, access control and egress logging, premises controls, the five-document paper stack carrying the 18 U.S.C. § 1833(b) whistleblower notice, vendor and data-room flows, onboarding hygiene that keeps you from importing a competitor's secrets, the hour-by-hour departure protocol, the first forty-eight hours of an investigation, and the litigation-readiness items that decide a preliminary injunction motion. Every item names the artifact it produces, the rule or case that makes it matter, and the specific way practitioners get it wrong — the reimaged laptop, the expired NDA, the executive who never signed an agreement, the retroactive confidentiality stamp that turns a security argument into a candor argument. One matter runs throughout: Halcyon Fluidics, a forty-person Erie pump manufacturer whose Midwest sales director resigned on Friday, January 9, 2026, and whose eleven-row register written two years earlier is the reason the case settled in April rather than collapsing in June. A Deadlines at a Glance table collects the statutory and rule-based clocks, from the three-year DTSA limitations period at § 1836(d) to the fourteen-day life of a Rule 65(b) temporary restraining order and the seven-day post-seizure hearing; doctrine lives in the companion article, and this document spends its length on execution.

IP and Technology > Trade Secrets | Checklist | Published 15 March 2026 - Updated 10 June 2026 | Casey Scott McKay - marksy.us

Summary. This is the working document for the two jobs a trade secret program has to do: build the record before anything goes wrong, and execute cleanly in the seventy-two hours after someone resigns. It runs eleven phases — inventory, classification, digital controls, premises controls, contracts and notices, third-party flows, onboarding, in-service maintenance, departure, incident response, and litigation readiness — and each item names the artifact it produces, the authority that makes it matter, and the specific way practitioners get it wrong. It carries one matter throughout: Halcyon Fluidics, Inc., a forty-person Erie pump manufacturer whose Midwest sales director resigned on Friday, January 9, 2026. A Deadlines at a Glance table collects the statutory and rule-based clocks. Doctrine lives in the companion article; this document assumes it and spends its length on execution.

Keywords: trade secret register · trade secret inventory · reasonable measures · defend trade secrets act · section 1833(b) notice · whistleblower immunity notice · departing employee protocol · exit interview certification · forensic imaging · egress logging · litigation hold · named-access list · nda survival clause · onboarding clean-device sweep · trade secret identification · protective order · attorneys eyes only · ex parte seizure order · spoliation · byod policy

What this checklist is for

Two things decide trade secret cases, and neither is the theft. The first is whether the plaintiff behaved, before the theft, like the information mattered — the "reasonable measures" element at 18 U.S.C. § 1839(3)(A). The second is whether the employer executed competently in the days after someone gave notice. This checklist covers both. Work it top to bottom and you will finish with a dated register, a defensible control set, a signed paper stack, and a departure file that a judge can read in ten minutes.

Who should use it. In-house counsel or the outside lawyer standing in for one; the HR leader who runs exits; the IT director who owns logging and offboarding; and litigation counsel triaging a departure that already happened. Phases 1 through 8 are a build project. Phases 9 through 11 are an emergency runbook — bookmark them separately.

What you'll need before you start.

Ninety minutes each with five to eight people: head of engineering or R&D, whoever actually runs manufacturing, the sales leader, the CFO or controller, and the network administrator.
Read access to the signed-agreement repository, the vendor contract file, and the identity provider's group memberships.
A straight answer from IT to one question: if I asked you today what a named employee opened, downloaded, printed, or copied to USB in the last twelve months, how long would it take and what could you not tell me?
A budget line. The full program runs roughly $31,000-$97,000 to build and $15,000-$35,000 a year to run for a company under 250 people — less than a single investigation and about a quarter of one preliminary injunction motion. The stage-by-stage build, model clause language, and cost tables are in Building a Trade Secret Program That Survives Litigation; the doctrine underneath every item here is in Trade Secrets and the DTSA: Protecting What You Cannot Register.

The worked example. Halcyon Fluidics, Inc. builds magnetically coupled sealless pumps for semiconductor wet-bench tools out of Erie, Pennsylvania. Forty employees, about $38 million in revenue. Its 2024 register has eleven rows. On Friday, January 9, 2026, Midwest regional sales director Dana Reyes resigned and went to Calder Process Systems. On Monday the twelfth, IT reported 2,100 file accesses in her final two weeks against a twelve-month baseline of roughly sixty, plus eleven USB insertions. Halcyon appears at the end of most phases below, showing what "done" looked like at that step.

The phases at a glance

| Phase | What you produce | Who owns it | Elapsed | |---|---|---|---| | 1. Inventory | A dated register, 10-20 rows, one owner per row | Counsel + function heads | 2-4 weeks | | 2. Classify and mark | A three-tier handling rule and a labeling scheme | Counsel + IT | 2-6 weeks | | 3. Digital controls | Named-access lists, 12 months of egress logs, a baseline | IT | 4-8 weeks | | 4. Premises controls | Visitor and clean-desk protocol; the remote-work equivalents | Facilities + IT | 2-4 weeks | | 5. Contracts and notices | Five signed document families, all carrying § 1833(b) | Counsel + HR | 4-8 weeks | | 6. Third parties | A docketed NDA inventory with indefinite trade secret tails | Counsel + contract owner | 4-10 weeks | | 7. Onboarding | Questionnaire, representations, clean-device certificate | HR + counsel | Per hire | | 8. Maintenance | Training records, entitlement reviews, an annual audit memo | Counsel | Annual | | 9. Departure | A dated exit file, per departure | HR → counsel → IT | 72 hours | | 10. Incident response | Hold, images, a triage report mapped to register rows | Counsel + examiner | 3-4 weeks | | 11. Litigation readiness | Identification statement, protective order, TRO package | Litigation counsel | 3-10 days |

Phase 1 — Inventory: build the register before anyone asks for it

[ ] Schedule five to eight ninety-minute interviews by function, not seniority, and have counsel commission and direct them.
- Why. Surveys produce a data map of every SharePoint site in the company. Interviews produce a short list of things that would actually hurt.
- Trap. Sending a form asking "what is confidential?" Everything comes back confidential, and you have built the IDX Systems pleading with a spreadsheet border around it. IDX Sys. Corp. v. Epic Sys. Corp., 285 F.3d 581, 583-84 (7th Cir. 2002).
[ ] Ask each interviewee the diagnostic question in operational form: if a competitor woke up tomorrow knowing this, what would change about our next four quarters? Then ask how long and how much it would cost them to work it out alone.
- Why. The second answer is your independent-economic-value evidence under 18 U.S.C. § 1839(3)(B) and your head-start-injunction duration in the same sentence.
[ ] Force-rank: each interviewee names five items and no more. Aggregate to ten to twenty rows for a company under 250 people.
[ ] Write each row against a fixed schema: item ID and short name; a one-paragraph filing-safe description with no formulas or values; category (technical, commercial, financial, negative know-how); a named human owner; systems and physical locations; the access group and headcount with access; protective measures in force; independent-development estimate in time and dollars; public-domain adjacency; date created and date last reviewed.
- Why. Those ten fields are, in order, your pleading reference, your complaint paragraph, your damages theory, your declarant, your preservation scope, your cross-examination number, your reasonable-measures column, your injunction duration, your "readily ascertainable" defense, and your contemporaneity proof.
- Authority. 18 U.S.C. § 1839(3); Restatement (Third) of Unfair Competition § 39 cmt. d (1995). The register schema is a close cousin of the Trademark Portfolio Inventory Template — if you already maintain one, add a trade secret worksheet rather than starting a new file.
[ ] Version the register and never delete a version. Archive each annual iteration with its date intact.
- Why. The register's evidentiary power comes entirely from being dated before the loss.
[ ] Mark the interview notes privileged and prepared in anticipation of litigation; decide deliberately that the final register is a business record you will produce.
- Trap. Burying the register in privilege. A document you will fight about producing is worth less than a document you hand the judge in the first ten minutes of a hearing.

Halcyon. Row 3 read: "SiC bushing sinter Profile — ramp rate, soak temperature and dwell, and argon/nitrogen partial-pressure schedule for the H-series bushing, as embodied in Process Spec PS-114 rev. C. Owner: A. Mielke, CTO. Location: PLM system, /Process/Restricted. Access: 6 named individuals. Estimated independent development: 3-4 years and $2.1M in furnace time and scrapped parts." Eleven rows, drafted in 2024, cost about $14,000.

Phase 2 — Classify in three tiers and mark like you mean it

[ ] Adopt exactly three tiers — Restricted, Confidential, Internal/Public — and write one handling rule per tier that an ordinary employee can follow without calling a lawyer.
- Trap. Five tiers. They collapse inside a year because nobody can distinguish tier 3 from tier 4, and inconsistency is the thing a defendant cross-examines on.
[ ] Put the register rows, and only the register rows, in the Restricted tier. Handling rule: named-individual access; no personal devices; no personal cloud; no attachments to external domains; access logged and reviewed quarterly.
[ ] Apply a distinctive Restricted legend with a document control number — "HALCYON RESTRICTED — TRADE SECRET / DOC PS-114-C" in header and footer — and a plain "Confidential" footer for the middle tier.
- Authority. Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279, 1300-01 (11th Cir. 2018) (failure to mark the very information later sued over helped sink the claim).
- Trap. Stamping everything. A company that marks four percent of its documents and can explain the rule is far better positioned than one that marks the cafeteria menu.
[ ] Apply the label at the system level — Microsoft Purview sensitivity labels, Google Drive labels, the PLM system's classification field, repository topic tags — so the marking travels with the file on export.
- Why. Manual header-stamping decays in about a quarter. System labels also give you a query: "show me every Restricted-labeled file that left the tenant in the last ninety days."
[ ] Never retro-stamp.
- Trap. Adding confidentiality legends after a departure. Forensic metadata carries the modification date, opposing counsel will find it, and the hearing stops being about your security posture and becomes about your candor. If you did not mark it, say so and lean on the other measures.

Phase 3 — Digital controls: access, egress logging, and the baseline

[ ] Reduce Restricted-tier access from groups to named individuals, with the row owner approving every addition in writing.
- Why. "Everyone in Engineering" is not need-to-know, and the headcount-with-access number is the first thing defense counsel puts on a demonstrative.
[ ] Run a quarterly entitlement review: the row owner receives the current access list, strikes what is stale, signs and dates it. Ten minutes per row, four times a year.
- Why. The signed reviews are the exhibit. The review itself is almost worthless if nobody signed it.
[ ] Turn on and retain twelve months of egress logging: file access, downloads, print jobs, USB mass-storage insertions, uploads to non-corporate domains, and external mail forwards.
- Why. "2,100 file accesses" means nothing to a judge without "against a baseline of about sixty." Anomaly evidence is comparative; thirty days of retention gives you the spike and no baseline.
- Trap. Assuming the defaults are enough. Microsoft Purview Audit (Standard) retains most audit records for 180 days, and Google Workspace keeps Drive and Login events for six months — both short of a full annual cycle. Upgrade the license tier or export to a SIEM or BigQuery and keep twelve to twenty-four months.
[ ] Confirm with IT that endpoint telemetry captures USB device serial numbers and the Windows USBSTOR registry key, setupapi.dev.log entries, link files, and shellbags survive a normal offboarding.
- Why. These are the artifacts that prove what was copied. They do not survive reimaging, which is why Phase 9 exists.
[ ] Write the personal-device and personal-cloud rule down, then enforce it technically — mobile device management enrollment with a wipeable corporate container if you permit bring-your-own-device.
- Authority. DM Trans, LLC v. Scott, 38 F.4th 608, 619-20 (7th Cir. 2022), affirmed denial of a preliminary injunction where the employer neither demanded deletion from personal devices nor verified it.
- Trap. A written prohibition that management routinely overrides for convenience. Yellowfin Yachts is a case about an employer that encouraged the executive to keep customer data on his own phone.
[ ] Decide the generative-AI question in writing: an approved-tools list, an enterprise agreement carrying a no-training commitment, prompt logging, and a flat prohibition on pasting Restricted-tier content into consumer tools.
- Why. Whether feeding a register row to a public model destroys secrecy is unsettled. Whether you had a policy is not, and that is the question the reasonable-measures analysis actually asks. Build the control set from the Generative AI IP Compliance Checklist and the governance layer from Deploying Generative AI Without Losing Your IP.
[ ] Do not let a full data-loss-prevention deployment become the reason the program has not launched. Native cloud audit logging plus an endpoint agent covers most of what you need at roughly $6-$25 per user per month.

Phase 4 — Premises, and the remote-work equivalents

[ ] Segregate the physical embodiments: locked cabinet or controlled room for master process specs, sample parts, formulation notebooks, and the failed-formulation file, with a sign-out log naming the person and the date.
- Authority. Rockwell Graphic Sys., Inc. v. DEV Indus., Inc., 925 F.2d 174, 176-80 (7th Cir. 1991) — numbered copies, a vault, sign-out logs, and vendor agreements were enough even though Rockwell was sloppy at the edges.
[ ] Badge-restrict the areas where Restricted work happens and keep the access records for twelve months.
[ ] Escort all visitors, log them by name, company, host, and time, and put a one-page confidentiality acknowledgment in front of anyone entering a Restricted area.
[ ] Ban photography in production areas by posted policy, and mean it for phones.
- Why. E.I. duPont deNemours & Co. v. Christopher, 431 F.2d 1012 (5th Cir. 1970), is a photography case. So is every plant tour that goes on LinkedIn.
[ ] Run a clean-desk rule, a locked-shredding contract, and secure-print release on every printer that can reach a Restricted document.
[ ] For a distributed workforce, substitute the equivalents and write them into the policy: no printing of Restricted material at home, privacy screens for client-facing roles, a prohibition on shared household devices and personal printers, and encrypted disk on every endpoint.
- Trap. Citing badge logs and a visitor book in a declaration for a company whose engineering team has not been in a building since 2021. A judge notices. If your controls are all digital, say so and make the digital ones excellent.

Phase 5 — Contracts and notices: five documents, one of which is free money

[ ] Confirm that every person with Restricted-tier access has signed a current employee confidentiality and proprietary rights agreement — and pull the actual PDF, do not trust the HRIS checkbox.
- Trap. Roughly one in five of these audits turns up an executive with no agreement at all, because the executive negotiated their own offer letter and it never came back to legal.
[ ] Put the whistleblower-immunity notice into every agreement family that governs trade secrets or confidential information — employee agreements, contractor and consultant forms, statements of work, intern paperwork, and separation agreements.
- Why. Omitting it does not kill the claim. It deletes exemplary damages of up to two times compensatory and attorney's fees against that person — the two remedies that make the case economically rational.
- Authority. 18 U.S.C. § 1833(b)(3)(A), (C); "employee" is defined at § 1833(b)(4) to include contractors and consultants. The alternative at § 1833(b)(3)(B) — cross-referencing a reporting policy — works only if the policy exists and the person received it. Put the clause in.
- Trap. Fixing the executive template and forgetting the one-page 1099 form. The agreements that fail are never the lawyered ones.
[ ] Convert every invention assignment to the present tense: "hereby irrevocably assigns," not "agrees to assign," plus a further-assurances covenant and a power of attorney coupled with an interest.
- Authority. FilmTec Corp. v. Allied-Signal Inc., 939 F.2d 1568, 1572-73 (Fed. Cir. 1991); Omni MedSci, Inc. v. Apple Inc., 7 F.4th 1148, 1154-56 (Fed. Cir. 2021) (a policy saying inventions "shall be the property of" the institution was intent, not a present assignment). The ownership questions underneath are worked through in Who Owns the Work, and the ownership-versus-permission line that decides who may sue is in Assignments vs. Licenses.
[ ] Add the state invention-assignment notice where required — California, Delaware, Illinois, Kansas, Minnesota, New Jersey, North Carolina, Utah, and Washington all carve out inventions developed entirely on the employee's own time without employer resources.
- Authority. Cal. Lab. Code § 2872 requires written notice that the agreement does not apply to inventions qualifying under Cal. Lab. Code § 2870.
[ ] Add protected-activity carve-outs preserving the right to communicate with government agencies, file charges, and discuss terms and conditions of employment.
- Authority. SEC Rule 21F-17(a), 17 C.F.R. § 240.21F-17(a); McLaren Macomb, 372 N.L.R.B. No. 58 (2023), on overbroad severance confidentiality and non-disparagement terms under Section 7 of the NLRA, 29 U.S.C. § 157.
[ ] Audit restrictive covenants against the state where the person lives and works, and repair or retire the unenforceable ones.
- Authority. Cal. Bus. & Prof. Code §§ 16600, 16600.1, 16600.5; Minn. Stat. § 181.988; 820 Ill. Comp. Stat. 90/10, 90/20; Mass. Gen. Laws ch. 149, § 24L; Colo. Rev. Stat. § 8-2-113; Wash. Rev. Code § 49.62.020; N.D. Cent. Code § 9-08-06; Okla. Stat. tit. 15, §§ 217, 219A.
- Trap. Attempting to enforce a void California noncompete. Section 16600.5 makes the attempt itself unlawful and gives the employee a private right of action with mandatory fees. Also check Cal. Lab. Code § 925 before you rely on an out-of-state choice-of-law or venue clause against a California worker.
[ ] Re-paper existing employees on the annual compensation cycle so the consideration question answers itself.

Phase 6 — Third parties, vendors, and data rooms

[ ] Build a single inventory of every counterparty holding Restricted information: contract manufacturers, design partners, resellers, testing labs, prospective acquirers, and joint developers. One row each, with the agreement, its term, its survival tail, and the named business owner.
[ ] Separate the term of the agreement from the survival of the confidentiality obligation, and give trade secrets an indefinite tail — five years for ordinary confidential information, "for so long as the information remains a trade secret" for the rest.
- Authority. Farmers Edge Inc. v. Farmobile, LLC, 970 F.3d 1027, 1033 (8th Cir. 2020) (information shared with a contractor with no confidentiality agreement and no protective practice did not qualify).
[ ] Docket every NDA and every confidentiality term with a 120-day pre-expiry alert routed to a named human, not a shared mailbox.
- Trap. The lapsed NDA is the single most common third-party failure and it is always a docketing failure, never a drafting one. Run it on the same calendar discipline described in Docketing Deadlines: Never Miss a Renewal; if you already maintain a portfolio calendar under Building and Managing a Trademark Portfolio, add a contract-expiry class to it.
[ ] Impose a hard technical control: no Restricted-tier file leaves the tenant to an external domain without a documented NDA reference.
- Why. Nothing damages a reasonable-measures showing faster than a production email attaching the spec eleven days before the NDA was signed.
[ ] Negotiate the residuals clause down to one thing — carve trade secrets out of it — and concede the rest cheerfully.
- Why. A broad residuals clause is functionally a license to use your trade secrets so long as nobody wrote them down.
[ ] Require flow-down in the contract: written confidentiality and invention-assignment agreements containing the § 1833(b) notice with every individual who touches the information; a named-access list you approve in writing before substitution; a designated facility or segregated network segment; encryption and marking obligations; audit rights; and expungement plus a signed destruction certificate at termination.
- Why. Your vendor's own employees and subcontractors are the exposure. The toll-manufacturing playbook has done this for decades and it transfers cleanly to software and design partners. Where confidentiality and permitted-use terms sit inside a broader license, draft them as load-bearing rather than boilerplate — the discipline carries over from Drafting a Trademark License That Survives and, at a simpler scale, How to Draft a Trademark License Agreement.
- Authority. Turret Labs USA, Inc. v. CargoSprint, LLC, No. 21-952, 2022 WL 701161, at *2-3 (2d Cir. Mar. 9, 2022) (summary order) — when your secret lives in a licensee's distribution channel, your reasonable measures are whatever your contract requires.
[ ] For joint development, attach a background-IP schedule signed and dated at closing, plus an express allocation of foreground IP by category.
- Why. Two hours at signing prevents eighteen months of expert discovery over who owned which improvement.
[ ] For any diligence process, tier the data room and run a named clean team firewalled from the counterparty's operating business for a defined period, with the Restricted material appearing last.
- Why. The deal that dies at diligence and reappears as a competitor roadmap eighteen months later is a preventable case. Apply the registered-rights analogue from Trademark Due Diligence in Mergers and Acquisitions, the item-level version in the Trademark Due Diligence Checklist, and the whole-portfolio view in the IP Due Diligence Toolkit.

Halcyon. Its contract sinterer, Delphos Ceramics, held PS-114 rev. C under a 2019 NDA with a three-year term and a three-year survival tail — meaning the obligation lapsed in 2025 while Delphos still had the file. The 2024 program review caught it. Halcyon re-papered with an indefinite trade secret tail, a named-access list of four, and a certificate that two obsolete revisions had been destroyed. That certificate cost nothing and closed the largest hole in the program.

Phase 7 — Onboarding: hire from competitors without buying their litigation

[ ] Send every candidate a written pre-offer questionnaire asking them to identify and attach all agreements with current or former employers containing confidentiality, non-competition, non-solicitation, or invention-assignment terms.
- Trap. Asking only about "non-competes." Covenants hide in offer letters, equity grants, bonus and commission plans, stock agreements, and handbooks. Prompt by document type or you will not get them.
[ ] Assess enforceability before the offer, not after the resignation: where the candidate lives and works, what the covenant restricts, whether the new role does that thing, and whether the state permits it at all.
[ ] Put three representations in the offer letter: no conflicting agreement; will not bring, load, or use any former-employer material in any form including personal devices and cloud accounts; has already searched personal devices, email, and cloud storage and returned or deleted anything found.
- Why. 18 U.S.C. § 1839(5)(B)(ii) reaches a defendant who knew or had reason to know the information came from someone under a duty. These sentences are how you show you did not.
[ ] Run a certified clean-device sweep on day one — personal laptop, phone, personal email, cloud accounts — with an IT staffer present or a scripted self-certification, signed and dated.
[ ] If anything turns up, quarantine it. Do not open it and do not delete it. Notify counsel and arrange return to the former employer through counsel.
- Trap. Deleting evidence you already know about. That is how a defensible onboarding becomes a spoliation motion under Fed. R. Civ. P. 37(e).
[ ] Quarantine the role for a defined period: reassign a salesperson's former accounts for the covenant period, or keep an engineer off the directly competing module for ninety days, and document the reassignment.
- Why. Cheap, provable, and it converts "reason to know" into "took affirmative steps."
[ ] Instruct the hiring manager in writing not to ask about the former employer's pricing, roadmap, or customer terms, and to report it if the new hire volunteers any.
- Why. That email is your exhibit. Its absence is the plaintiff's.
[ ] Do not hire teams. Make sequential individual offers, do not condition one on another, pay no referral bonuses to candidates recruiting former colleagues, and preserve the evidence that the candidate initiated contact.
[ ] Decide indemnification consciously, and decide the opinion-letter question the same way.
- Trap. A third-party opinion letter can defeat a punitive-damages theory on tortious interference — and offering it in evidence can waive privilege as to that lawyer's communications. Commission it knowing you may have to use it.

Phase 8 — In-service: training, trigger events, and the annual audit

[ ] Run a twenty-minute onboarding module covering the three tiers, the handling rules, the personal-device rule, the AI rule, and the reporting line, with tracked completion.
[ ] Run an annual refresh — ten minutes for everyone, forty-five for Restricted-tier holders — and vary the content year to year so the completion records do not read as a formality.
[ ] Re-open the file automatically on four events: promotion or transfer into Restricted access; conversion between contractor and employee in either direction; a role going remote or hybrid; and a new product line or acquisition.
[ ] Route conference abstracts, technical marketing copy, spec sheets, open-source contributions, patent drafts, and job postings through the register owner before publication.
- Trap. The job posting. A listing seeking "experience with argon-partial-pressure sintering control for SiC bushings" tells a competitor precisely what you have. The pre-ship review habit is set out in Launching a Website or App Without Legal Debt, with the surrounding issues in The Legal Layers of a Website.
[ ] Run an annual program audit on a fixed date: agreements on file, entitlement reviews signed, NDA docket clean, exit files complete. Produce a short memo listing exceptions and owners.
- Why. Same cadence and same output as the Annual Trademark Portfolio Review Checklist.
- Trap. An audit memo identifying a gap, followed a year later by a second memo identifying the same gap. Close findings or stop writing memos — an open, repeated, documented gap is worse than no audit at all.

Phase 9 — Departure: the seventy-two hours that decide the case

The clock starts at notice, not at the last day.

[ ] Hour 0-2: notify legal and HR; pull the departing employee's register-row access list and every signed agreement she is under.
[ ] Hour 0-4: suspend log rotation, disable auto-wipe and auto-delete on her accounts and devices, and preserve mailbox, chat, and cloud drive in place.
- Why. The single most valuable two minutes in the process. Everything downstream depends on artifacts that a retention policy is about to destroy on schedule.
[ ] Hour 2-8: risk-tier the departure. Competitor destination? Restricted-tier access? Anomaly in the logs? Any two of three makes it a forensic exit.
[ ] Hour 4-24: pull ninety days of access, download, print, USB, and external-send logs and compare them against the twelve-month baseline.
[ ] Hour 24-72: run the exit interview with HR, not the manager she is leaving, using counsel's script. Ask where she is going and what she will be doing there, and write the answers verbatim.
- Why. Evasion at the exit interview was the fact that mattered most in PepsiCo, Inc. v. Redmond, 54 F.3d 1262, 1270 (7th Cir. 1995).
[ ] Walk the register in the interview: name each row she could reach and ask, item by item, whether she holds any copy in any location — personal email, personal cloud, personal phone, USB drives, printed material at home.
[ ] Obtain a signed return-and-deletion certification that covers personal devices and cloud accounts and that ends with a blank line for materials she wishes to disclose.
- Why. Employees fill in that line more often than lawyers expect, and a truthful disclosure resolves the matter without a lawsuit. A false certification converts a downloading case into a candor case, which is a much better case.
[ ] Deliver the continuing-obligations letter at the interview, with copies of the operative agreements attached, and get a signed acknowledgment of receipt.
- Why. It removes the ignorance defense permanently.
[ ] Last day: collect laptop, phone, badge, tokens, keys, and removable media. Chain-of-custody tag them and shelve them. Do not reimage.
- Trap. Reimaging because IT needs the hardware for the next hire. Buy the next hire a laptop. A wiped device destroys the deleted-file artifacts, the USB registry entries, the link files, and the shellbags that prove what was copied — and it puts you in the Fed. R. Civ. P. 37(e) conversation instead of the defendant.
[ ] Last day: disable SSO, VPN, mail, chat, code repository, CRM, expense system, and every personal-device access path, including mail profiles on her phone and any shared service account she knew the password to.
[ ] Shorten the runway. Once you know she is going to a competitor, end the relationship promptly and pay out the notice period.
- Why. Two weeks of network access after a resignation is two weeks of collection opportunity.
[ ] Days 1-5, if risk-tiered high: forensic image of the laptop, the company phone, and any personal device she used, by a qualified examiner. Budget $900-$2,500 per device.
[ ] Days 30, 60, and 90: monitor customer defections, LinkedIn activity, competitor product announcements, and RFP losses.
- Why. Misappropriation usually surfaces at the first renewal cycle, not in the first week.

Halcyon. Reyes signed the return-and-deletion certification on January 9 and left the disclosure line blank. Six days later the triage report showed 1,840 files copied to two USB devices on January 6 and 7. That blank line was worth more to Halcyon's motion than the file count.

Phase 10 — Incident response: the first forty-eight hours

[ ] Issue the litigation hold in writing today, scoped to the departing employee's custodial data, the register rows at issue, the access and egress logs, the exit file, and the accounts of everyone who worked with her. Suspend auto-deletion.
- Authority. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216-18 (S.D.N.Y. 2003); Fed. R. Civ. P. 37(e), which authorizes curative measures for prejudice and, on a finding of intent to deprive, an adverse-inference instruction or dismissal.
[ ] Re-issue the hold every ninety days and keep the acknowledgments.
[ ] Retain the forensic examiner through outside counsel, with an engagement letter describing the scope as assisting counsel in rendering legal advice in anticipation of litigation.
- Why. The examiner's declaration will carry your preliminary injunction motion, so retain someone who can survive a Fed. R. Evid. 702 challenge under the rule as amended December 1, 2023. Assume the final report will be produced and write every draft accordingly. The expert-selection and cross-examination problems are the same ones catalogued in the Evidence and Expert Witness Toolkit, and the admissibility playbook mirrors Commissioning and Attacking a Trademark Survey.
[ ] Take write-blocked images with recorded hash values before any analysis, and document chain of custody on a signed form. Then work only from the images.
[ ] Know the four boundaries you must not cross.
- Trap. Logging into her personal Gmail with credentials cached in the browser (Stored Communications Act, 18 U.S.C. § 2701); subpoenaing content from her provider (18 U.S.C. § 2702(a) bars disclosure, and civil content subpoenas are routinely quashed — get it from her in discovery); recording a call without telling her (federal law permits one-party consent under 18 U.S.C. § 2511(2)(d), but California and roughly a dozen states require all-party consent); and remote-wiping her personal phone, which destroys evidence and creates a conversion claim in one keystroke.
[ ] Ask the examiner five questions and no more: what left the environment, when, by what path, whether it was opened after departure, and what remains.
[ ] Map every finding to a register row. Discard findings that do not map.
- Why. Pleading unmapped findings is how a strong case becomes an overbroad one, and overbreadth is the platform for a fee motion under 18 U.S.C. § 1836(b)(3)(D).
[ ] Interview coworkers with Upjohn warnings every time, including the CEO: you represent the company, the privilege belongs to the company, and the company may waive it. Upjohn Co. v. United States, 449 U.S. 383, 394-95 (1981).
[ ] Choose among three moves before spending another dollar.
- No forensic evidence, only suspicion and a competitor hire: do not send a demand. Keep monitoring. An unsupported demand to the new employer is a tortious-interference claim waiting to happen and a bad-faith record under § 1836(b)(3)(D). The sequencing discipline is in the Pre-Litigation Enforcement Checklist.
- Evidence, but marginal items: send a continuing-obligations letter to the employee and the new employer asking for a certification and a deletion protocol. Most matters end here. Construction and tone are worked through in Sending an Effective Cease-and-Desist Letter, with a starting structure in the Cease-and-Desist Letter Template and the receiving side in Responding to a Cease-and-Desist Letter.
- Solid items plus evidence of use, deletion, or an unresponsive defendant: file, and move for a TRO the same day or within seventy-two hours.
[ ] Before any demand goes out, identify the information by register short name and category, never by content.
- Trap. A demand letter that describes the secret in detail is itself a disclosure, and it will be Exhibit A to the defendant's argument that you did not treat it as secret.
[ ] Offer a standstill and neutral-inspection agreement where the defendant is responsive: suspend use pending inspection, deliver devices and accounts to an agreed neutral, search by agreed terms with hit counts reported to both sides before any content production, toll the limitations period, and split costs.
- Why. The cheapest good outcome available. You get the evidence without expedited-discovery cost and without a Rule 65(c) bond, and a bad report for the defendant produces a settlement rather than a fight.

Phase 11 — Litigation readiness

[ ] Draft the trade secret identification statement before the complaint, in three columns: the secret, named and versioned and bounded; where it lives and who had it; and why it is not readily ascertainable.
- Why. The third column decides the motion and is the one plaintiffs skip. If you cannot articulate why a competent competitor could not have worked it out, you probably do not have the secret.
- Authority. IDX, 285 F.3d at 583-84; Cal. Civ. Proc. Code § 2019.210 (California state-court plaintiffs must identify with reasonable particularity before discovery commences; whether it applies in federal court sitting in California is genuinely unsettled); InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653, 657-59 (9th Cir. 2020).
[ ] Describe the dimensions with precision and withhold the values. "The three-stage soak schedule at Section 4.2 of PS-114 rev. C, comprising a specified dwell temperature, dwell duration, and argon partial pressure, together with the ramp rate at Section 4.1" identifies the secret without printing it.
[ ] Assert four well-supported items rather than forty. Each weak item is an item the defendant wins on.
[ ] Plead the jurisdictional hook expressly — the secret relates to a product or service used in or intended for use in interstate or foreign commerce, 18 U.S.C. § 1836(b)(1) — and plead post-May 11, 2016 acquisition, disclosure, or use in dated terms.
[ ] Plead both doors: acquisition by improper means under § 1839(5)(A) and use or disclosure in breach of a duty under § 1839(5)(B). They carry different proof and reach different defendants.
[ ] Add a Computer Fraud and Abuse Act count only where the defendant reached something she had no right to access at all.
- Authority. Van Buren v. United States, 593 U.S. 374, 389-96 (2021) — "exceeds authorized access" is a gates-up-or-down inquiry, not a misuse inquiry. Watch UTSA § 7 displacement of parallel tort claims.
[ ] If source code is in play, register the copyright and use the trade secret deposit option.
- Authority. 37 C.F.R. § 202.20(c)(2)(vii) permits depositing identifying portions with trade secret material blocked out — you can register without publishing the secret. Standard electronic application, $65. Mechanics in Registering a Copyright and the Copyright Registration Checklist; elements in Proving Copyright Infringement; the filing sequence in Filing a Copyright Infringement Complaint in Federal Court and its companion checklist.
[ ] Choose the forum deliberately. The DTSA gives a federal door with no diversity and no amount in controversy; pleading state-only claims is legitimate where state law is better or you want to defeat removal. Check Cal. Lab. Code § 925 before relying on a forum clause against a California worker.
- Why. The forum reflex — file where you always file — is the same mistake diagnosed in Federal Court vs. TTAB.
[ ] Get a three-tier protective order entered before the first production: Confidential; Highly Confidential — Attorneys' Eyes Only; and Restricted Source Code / Process, reviewable only on a standalone non-networked machine at counsel's office with printing limits and a log.
- Authority. Fed. R. Civ. P. 26(c)(1)(G); 18 U.S.C. § 1835(b) (no court-authorized disclosure of asserted trade secret material without an opportunity to file under seal). Board-practice analogue in Understanding TTAB Discovery and the Protective Order.
- Trap. A two-tier order whose "in-house counsel" definition quietly admits the defendant's engineering VP. Read the AEO definition as if the person you least want reading the register will be the one who does.
[ ] Fight for four provisions: a prosecution bar, a Fed. R. Evid. 502(d) non-waiver order, an expert-disclosure and objection procedure, and a return-or-destroy obligation at case end covering the neutral examiner's images.
[ ] File public redacted versions with surgical redactions and support each sealing request item by item.
- Authority. Nixon v. Warner Communications, Inc., 435 U.S. 589, 597-99 (1978); Baxter International, Inc. v. Abbott Laboratories, 297 F.3d 544, 545-47 (7th Cir. 2002); Center for Auto Safety v. Chrysler Group, LLC, 809 F.3d 1092, 1096-1102 (9th Cir. 2016).
- Trap. Moving to seal an entire brief on a TRO clock. The motion gets denied and you refile with the clock running.
[ ] Assemble the emergency package and file it all at once: verified complaint or declaration supplying specific facts (Fed. R. Civ. P. 65(b)(1)(A)); a four-factor memorandum; three declarations — register owner, forensic examiner, business executive on concrete irreparable harm; a Rule 65(d)(1) proposed order drafted as if a marshal must enforce it; a proposed Rule 65(c) bond figure; the Rule 65(b)(1)(B) certification if ex parte; and a motion for expedited discovery, since Fed. R. Civ. P. 26(d)(1) bars discovery before the Rule 26(f) conference absent an order.
- Why. The mechanics carry over almost unchanged from Moving for a TRO or Preliminary Injunction and the Preliminary Injunction Motion Checklist; the four factors themselves are unpacked in Preliminary Injunctions in Trademark Cases. Filing fee in district court is currently $405 — the $350 statutory fee at 28 U.S.C. § 1914(a) plus the $55 administrative fee.
[ ] Ask for a narrow, preservation-focused order and a head-start duration drawn from the register's independent-development estimate.
- Authority. 18 U.S.C. § 1836(b)(3)(A)(i)(I) — an injunction may not prevent a person from entering an employment relationship, and conditions on employment must rest on evidence of threatened misappropriation rather than on what the person knows. Opposing counsel will quote it; write your proposed order so it does not bite.
[ ] Ask for seizure only if you can prove, with specific facts, that a Rule 65 order would not work.
- Authority. 18 U.S.C. § 1836(b)(2)(A)(ii)(I) is the gate, and courts start from the assumption that a TRO works. Compare OOO Brunswick Rail Management v. Sultanov, No. 5:17-cv-00017, 2017 WL 67119, at *2 (N.D. Cal. Jan. 6, 2017), where the court ordered a phone and laptop delivered at the hearing but refused to seize email accounts.
- Trap. A thin seizure motion hands the defendant a wrongful-seizure counterclaim with its own fee shift under § 1836(b)(2)(G) plus a bad-faith record for the merits.
[ ] Preserve evidence of your own loss from day one — lost bids, discounted renewals, documented pricing pressure — not only the defendant's gain.
- Authority. Syntel Sterling Best Shores Mauritius Ltd. v. TriZetto Group, Inc., 68 F.4th 792, 804-12 (2d Cir. 2023), vacated a $285 million avoided-cost award where the owner lost no sales; compare Epic Systems Corp. v. Tata Consultancy Services Ltd., 980 F.3d 1117, 1128-35 (7th Cir. 2020). The proof problems are the same ones worked in Proving Trademark Damages and Disgorging Profits After Romag.
[ ] Confirm, before filing, that the operative agreement contains the § 1833(b) notice. If it does not, price the case without exemplary damages or fees and tell the client that number today.

Halcyon's outcome. Filed January 26, 2026 in the Western District of Pennsylvania against Reyes and Calder. Two asserted register rows, not eleven — the landed-cost model and the customer-specific margin sheets. TRO on stipulation two days later: no use, devices to a neutral, hit-count protocol. The neutral found the margin sheets had been opened twice on a Calder laptop. Settled in April: a two-year use injunction, $310,000, destruction certified by the neutral, and an agreed onboarding protocol going forward. Total spend, about $240,000. What won it was an eleven-row register from 2024, six named-access accounts, a certification Reyes falsified on January 9, and twelve months of logs.

Common Mistakes

| Mistake | What it costs | Fix | |---|---|---| | Reimaging the departing employee's laptop | The deleted-file artifacts, USB registry entries, link files, and shellbags — and a Rule 37(e) motion against you | Chain-of-custody tag and shelve every device from a competitor departure for at least twelve months | | Building the inventory after the resignation | Every register row is dated after the theft and reads as litigation-driven | Write it now; version it annually; never delete a version | | Marking everything "Confidential" | Marking nothing, in the eyes of a fact-finder | Mark the Restricted tier obsessively and everything else lightly | | Missing the § 1833(b) notice in the contractor form | Exemplary damages and fees, deleted silently | Audit every agreement family, not just the lawyered ones | | Thirty-day log retention | The spike with no baseline, and a defense expert explaining that salespeople download things | Twelve months minimum; export to a SIEM if the license tier will not carry it | | Asserting eleven secrets when the forensics support two | Credibility on the two, plus a fee-motion platform under § 1836(b)(3)(D) | Map every finding to a register row and plead only what maps | | Sending a demand before the forensics are done | A tortious-interference counterclaim and a bad-faith record | Finish the triage report first; a standstill agreement is cheaper than both | | The NDA that expired while the relationship continued | The Farmers Edge and Turret Labs posture — sharing without a leash | Indefinite trade secret survival tail plus a 120-day docket alert to a named human | | Logging into the ex-employee's personal email | Stored Communications Act exposure, 18 U.S.C. § 2701, and the moral high ground | Get it from her in discovery | | Retro-stamping documents after the fact | The hearing becomes about your candor | If you did not mark it, say so and rely on the other measures |

Deadlines at a Glance

| Clock | Length | Authority | |---|---|---| | DTSA limitations period | 3 years from discovery or reasonable discoverability; continuing misappropriation is a single claim | 18 U.S.C. § 1836(d) | | State UTSA limitations period | 3 years in most adopting states | UTSA § 6 | | DTSA effective date | Misappropriation must occur on or after May 11, 2016 | Pub. L. No. 114-153 | | § 1833(b) notice obligation | Applies to agreements entered into or updated after May 11, 2016 | 18 U.S.C. § 1833(b)(3) | | Preservation duty attaches | When litigation is reasonably anticipated — at notice of resignation in a competitor departure | Zubulake, 220 F.R.D. at 216-18; Fed. R. Civ. P. 37(e) | | Exit protocol | Hold at hour 0-4; logs by hour 24; certification by hour 72 | Practice, not rule | | TRO issued without notice | Expires in 14 days unless extended for good cause or by consent | Fed. R. Civ. P. 65(b)(2) | | Post-seizure hearing | At the earliest possible time, not later than 7 days after the order issues | 18 U.S.C. § 1836(b)(2)(B)(v), (F) | | Discovery before the Rule 26(f) conference | Barred absent stipulation or court order | Fed. R. Civ. P. 26(d)(1) | | Rule 26(f) conference | At least 21 days before the scheduling conference or scheduling order | Fed. R. Civ. P. 26(f)(1) | | Scheduling order | Within 90 days after any defendant is served or 60 days after any defendant appears | Fed. R. Civ. P. 16(b)(2) | | Litigation hold re-issuance | Every 90 days, with acknowledgments retained | Practice | | Entitlement review | Quarterly, signed and dated by the row owner | Practice | | Egress log retention | 12 months minimum, 24 preferred | Practice | | NDA expiry alert | 120 days before the confidentiality term lapses | Practice | | Illinois covenant review period | 14 calendar days to review, plus written advice to consult counsel | 820 Ill. Comp. Stat. 90/20 | | Massachusetts noncompete notice | By the earlier of a formal offer or 10 business days before commencement | Mass. Gen. Laws ch. 149, § 24L(b) | | Washington noncompete disclosure | In writing no later than acceptance of the offer | Wash. Rev. Code § 49.62.020 | | Colorado covenant notice | Separate written notice before acceptance; thresholds indexed annually | Colo. Rev. Stat. § 8-2-113 | | Patent application publication | 18 months from earliest priority, absent a nonpublication request | 35 U.S.C. § 122(b) |