Regulation map for industrial data: IP, export controls, and cybersecurity rules

Layer 1: Trade secrets and IP on recipes and CAD files

Process recipes (chemical ratios, heat-treatment curves, curing times) and CAD/CAM files are usually protected as trade secrets, not patents. Manufacturers often prefer secrecy over patenting because a patent requires public disclosure and expires (typically 20 years from filing under the WIPO Patent Cooperation Treaty framework), while a trade secret can last indefinitely if kept confidential.

In the US, the Defend Trade Secrets Act (2016) gives trade secret owners a federal civil cause of action. In the EU, the Trade Secrets Directive (2016/943) harmonizes protection across member states. Both require the owner to show "reasonable measures" were taken to keep the information secret, things like access controls, NDAs, encryption, and audit logs.

Practical governance implication: if you can't show a log of who accessed the recipe file and when, you may struggle to prove it was a protected secret at all in litigation. Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → here isn't just IT hygiene, it's the evidentiary basis for your legal claim.

Concrete example

A Tier 1 automotive supplier stores battery cell chemistry ratios in a PLM system. If a departing engineer downloads the file to a personal drive, the company's ability to sue under trade secret law depends heavily on whether access was role-restricted, watermarked, and logged, versus sitting on an open shared drive.

Layer 2: export controls (ITAR and EAR)

Some manufacturing data isn't just proprietary, it's controlled by the state.

• ITAR (International Traffic in Arms Regulations), administered by the US State Department's Directorate of Defense Trade Controls, covers defense articles and services listed on the US Munitions List. This includes many aerospace and defense CAD files, technical data packages, and even manufacturing know-how, regardless of whether the item is physically exported. Sharing a drawing with a foreign national engineer inside a US facility can itself count as a "deemed export."
• EAR (Export Administration Regulations), administered by the US Commerce Department's Bureau of Industry and Security (BIS), covers dual-use items, technology with both civilian and military applications, like certain semiconductors, machine tools, and advanced materials.

The EU has its own parallel regime: the EU Dual-Use Regulation (2021/821), enforced by national export control authorities in each member state.

Why this matters for data governance specifically: export control compliance is fundamentally an *access control* problem. A file doesn't need to cross a border to violate ITAR, it just needs to be visible to the wrong person. This means:

• Cloud storage location matters (some ITAR data cannot legally sit on servers accessible from outside the US without a license).
• User nationality and citizenship status must be tracked as a data access attribute, not just role or seniority.
• Even a screen-share in an engineering review meeting can be a controlled "export" if a non-US person is in the room.

A simplified access rule (illustrative logic)

This is the kind of rule that must be enforced at the system level (identity and access management, or IAM), not just written into an employee handbook. Manual compliance doesn't scale past a few dozen engineers.

Layer 3: Cybersecurity requirements (IEC 62443 and NIST frameworks)

Even if data is correctly classified for IP and export purposes, it still needs a technical security standard for the systems that hold it, especially operational technology (OT) like PLCs (programmable logic controllers) and SCADA (supervisory control and data acquisition) systems that run physical equipment.

IEC 62443 is the leading international standard series for industrial automation and control system (IACS) cybersecurity, developed by the International Electrotechnical Commission. It defines security levels (SL 1 through SL 4, increasing rigor) and applies to both the manufacturer of control equipment and the operator running it on the plant floor.

In the US, manufacturers handling defense-related data must also meet CMMC (Cybersecurity Maturity Model Certification), run by the Department of Defense, which layered onto NIST SP 800-171 controls. In the EU, the NIS2 Directive (Network and Information Security Directive, in force since 2023) extends cybersecurity obligations to a wider range of manufacturers deemed "important" or "essential" entities, with penalties enforced by national authorities.

Practical governance implication: OT systems (the machines) and IT systems (the enterprise network) historically had separate security cultures. IEC 62443 pushes manufacturers to segment networks (so a breach in the office email system can't reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → the CNC (computer numerical control) machine controllers) and to inventory every connected device, because you can't secure what you haven't mapped.

Concrete example

The 2017 NotPetya malware attack, which spread through a compromised Ukrainian accounting software update, caused an estimated $10 billion in global damage (estimate, widely cited, exact figure debated) and shut down production lines at Maersk and Merck, both manufacturers with connected OT systems. It's a standard case study for why IT/OT network segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → isn't optional. For a technical primer, ENISA's threat landscape reports are a free, credible starting point.

🎬 [VIDEO: "What is IEC 62443? Industrial Cybersecurity Explained" - youtube.com - search for recent explainer content from ISA (International Society of Automation) or CISA channels covering IEC 62443 security levels and IT/OT segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → basics]

How the three layers stack in practice

Think of a single technical drawing moving through its lifecycle:

1. Created in CAD: it's a trade secret from the moment of creation if handled confidentially.

2. Classified for export: engineering or legal reviews it against the US Munitions List or the Commerce Control List to see if ITAR or EAR applies.

3. Stored and transmitted under a cybersecurity standard: IEC 62443 (if it touches OT systems) or CMMC/NIST 800-171 (if it's defense-related data in the US), or NIS2-aligned controls in the EU.

A practical audit checklist for a manufacturing data team should therefore ask, for any sensitive data stream:

• Classification: Is this trade secret, export-controlled, both, or neither? Who signed off on that classification, and when was it last reviewed?
• Access mapping: Does the access control list match the classification (nationality checks for ITAR, role-based limits for trade secrets)?
• Audit trail: Is there a timestamped log of every access, download, and transmission, sufficient to satisfy a "reasonable measures" test in litigation or a BIS/State Department inquiry?
• Network segmentation: Is the OT environment holding this data isolated per IEC 62443 zone/conduit principles, so a phishing email can't reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → the machine controller?
• Third parties: Do suppliers and contract manufacturers with access meet the same standard? (Supply chain is the most common failure point, since your controls are only as strong as your weakest subcontractor's.)

Key Takeaways

• Manufacturing data often carries multiple, stacked legal statuses at once: trade secret protection (Defend Trade Secrets Act in the US, Trade Secrets Directive in the EU), export control status (ITAR/EAR in the US, Dual-Use Regulation in the EU), and a cybersecurity compliance obligation (IEC 62443, CMMC, NIS2).
• Export control compliance is an access control problem first: nationality and location of the viewer matter as much as the sensitivity of the file itself, and "deemed exports" can happen without any file ever crossing a border.
• Trade secret protection is only as strong as your evidence of "reasonable measures", meaning access logs, encryption, and role-based restrictions aren't just IT best practice, they're the legal foundation of your claim.
• IEC 62443 pushes manufacturers to segment IT and OT networks and inventory every connected device, directly addressing the lesson of incidents like NotPetya (2017), where a single infected update froze physical production lines.
• A working audit checklist covers four things for every sensitive data stream: classification, access mapping, audit trail, and third-party (supplier) compliance, since supply chains are the most common point of failure.