# Regulation mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → for industrial data: IP, export controls, and cybersecurity rules
A single CAD file for a jet engine turbine blade can trigger three separate legal regimes before an engineer even hits "save as." It may contain a trade secret (the geometry), be subject to export control (because it describes a defense-related part), and live on a network that must meet a cybersecurity standard (because a supplier's breach could leak all three). Manufacturing data is rarely governed by one rule. It's governed by a stack.
This lesson maps that stack: intellectual property (IP) protections, export control regimes, and cybersecurity requirements, and shows how they interact on the factory floor and in the PLM (product lifecycle management) system.
In banking or retail, most sensitive data is about people: names, transactions, health records. In manufacturing, the crown jewels are often about *things*: process recipes, tolerances, alloy compositions, machine parameters, and CAD/CAM (computer-aided design/manufacturing) files.
This shifts the governance question. It's not just "is this personal data?" (GDPR's core question in the EU) but also "is this a trade secret, a controlled technology, or both?" A single file can be all three at once, and each status carries a different set of rules about who can access it, where it can be stored, and who can even look at it if they hold the wrong passport.
Process recipes (chemical ratios, heat-treatment curves, curing times) and CAD/CAM files are usually protected as trade secrets, not patents. Manufacturers often prefer secrecy over patenting because a patent requires public disclosure and expires (typically 20 years from filing under the WIPO Patent Cooperation Treaty framework), while a trade secret can last indefinitely if kept confidential.
In the US, the Defend Trade Secrets Act (2016) gives trade secret owners a federal civil cause of action. In the EU, the Trade Secrets Directive (2016/943) harmonizes protection across member states. Both require the owner to show "reasonable measures" were taken to keep the information secret, things like access controls, NDAs, encryption, and audit logs.
Practical governance implication: if you can't show a log of who accessed the recipe file and when, you may struggle to prove it was a protected secret at all in litigation. Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → here isn't just IT hygiene, it's the evidentiary basis for your legal claim.
A Tier 1 automotive supplier stores battery cell chemistry ratios in a PLM system. If a departing engineer downloads the file to a personal drive, the company's ability to sue under trade secret law depends heavily on whether access was role-restricted, watermarked, and logged, versus sitting on an open shared drive.
Some manufacturing data isn't just proprietary, it's controlled by the state.
The EU has its own parallel regime: the EU Dual-Use Regulation (2021/821), enforced by national export control authorities in each member state.
Why this matters for data governance specifically: export control compliance is fundamentally an *access control* problem. A file doesn't need to cross a border to violate ITAR, it just needs to be visible to the wrong person. This means:
IF file.classification == "ITAR" AND user.citizenship != "US":
IF NOT license_on_file(user, file):
DENY_ACCESS
LOG_ATTEMPT(user, file, timestamp)This is the kind of rule that must be enforced at the system level (identity and access management, or IAM), not just written into an employee handbook. Manual compliance doesn't scale past a few dozen engineers.
Even if data is correctly classified for IP and export purposes, it still needs a technical security standard for the systems that hold it, especially operational technology (OT) like PLCs (programmable logic controllers) and SCADA (supervisory control and data acquisition) systems that run physical equipment.
IEC 62443 is the leading international standard series for industrial automation and control system (IACS) cybersecurity, developed by the International Electrotechnical Commission. It defines security levels (SL 1 through SL 4, increasing rigor) and applies to both the manufacturer of control equipment and the operator running it on the plant floor.
In the US, manufacturers handling defense-related data must also meet CMMC (Cybersecurity Maturity Model Certification), run by the Department of Defense, which layered onto NIST SP 800-171 controls. In the EU, the NIS2 Directive (Network and Information Security Directive, in force since 2023) extends cybersecurity obligations to a wider range of manufacturers deemed "important" or "essential" entities, with penalties enforced by national authorities.
Practical governance implication: OT systems (the machines) and IT systems (the enterprise network) historically had separate security cultures. IEC 62443 pushes manufacturers to segment networks (so a breach in the office email system can't reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → the CNC (computer numerical control) machine controllers) and to inventory every connected device, because you can't secure what you haven't mapped.
The 2017 NotPetya malware attack, which spread through a compromised Ukrainian accounting software update, caused an estimated $10 billion in global damage (estimate, widely cited, exact figure debated) and shut down production lines at Maersk and Merck, both manufacturers with connected OT systems. It's a standard case study for why IT/OT network segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.Voir la définition complète → isn't optional. For a technical primer, ENISA's threat landscape reports are a free, credible starting point.
🎬 [VIDEO: "What is IEC 62443? Industrial Cybersecurity Explained" - youtube.com - search for recent explainer content from ISA (International Society of Automation) or CISA channels covering IEC 62443 security levels and IT/OT segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.Voir la définition complète → basics]
Vérification des acquis
1. Why might a manufacturer choose to protect a heat-treatment process recipe as a trade secret rather than patent it?
2. Why is a single manufacturing data file (like a CAD drawing) often governed by multiple, overlapping legal regimes simultaneously?
3. How does the core governance question for manufacturing data typically differ from the core governance question in sectors like banking or retail?
4. Select ALL correct answers about why a single CAD file might trigger multiple legal regimes at once.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about what distinguishes manufacturing's 'crown jewel' data from typical sensitive data in banking or retail.
Sélectionnez toutes les réponses correctes.
Think of a single technical drawing moving through its lifecycle:
1. Created in CAD: it's a trade secret from the moment of creation if handled confidentially.
2. Classified for export: engineering or legal reviews it against the US Munitions List or the Commerce Control List to see if ITAR or EAR applies.
3. Stored and transmitted under a cybersecurity standard: IEC 62443 (if it touches OT systems) or CMMC/NIST 800-171 (if it's defense-related data in the US), or NIS2-aligned controls in the EU.
A practical audit checklist for a manufacturing data team should therefore ask, for any sensitive data stream: