Protecting Proprietary Information & Intellectual Property

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Protecting Proprietary Information & Intellectual Property

Key Takeaways Explain This Topic AI

The four types of intellectual property are patents, trademarks, copyrights, and trade secrets, each protecting a different kind of asset.

A U.S. utility patent protects a new, non-obvious, and useful invention for 20 years from the filing date.

A trade secret has no fixed expiration and requires no registration, but protection depends on the owner taking reasonable measures to keep the information secret.

Insider threat monitoring and data-loss-prevention tools detect anomalous access or exfiltration activity that preventive measures like NDAs and training cannot catch in real time.

Last updated: July 2026

The Four Types of Intellectual Property

Protecting an organization's competitive position requires understanding which of four distinct legal mechanisms applies to a given information asset, because each has different requirements, different durations, and different enforcement mechanisms.

IP Type What It Protects Registration Required? Duration

Patent A new, non-obvious, and useful invention, process, machine, or composition of matter Yes -- formal application and examination Generally 20 years from the filing date

Trademark A word, phrase, symbol, or design identifying the source of goods or services Not required for common-law rights, but federal registration strengthens enforcement Potentially indefinite, renewable as long as the mark remains in commercial use

Copyright Original works of authorship -- software, literature, architecture, training materials No -- protection is automatic upon fixation in a tangible medium Life of the author plus 70 years for individual works; 95 years from publication (or 120 from creation) for works made for hire

Trade secret Information with independent economic value that is not generally known and is kept secret No -- registration would destroy the secrecy the protection depends on Indefinite, as long as reasonable secrecy measures are maintained

Trade secrets are the IP type most directly within a security manager's operational control: unlike a patent or copyright, which depend on a legal filing, a trade secret's protection depends entirely on the organization's continuous security practice. If reasonable secrecy measures lapse, the legal protection lapses with them.

Trademark protection also illustrates how registration status changes available remedies: an unregistered mark can still use the TM (or SM for services) symbol to assert common-law rights, but only a mark registered with the U.S. Patent and Trademark Office may use the (R) symbol, and registration provides nationwide priority plus access to federal court remedies that common-law rights alone do not guarantee. A CPP-level security program should track which of the organization's brand assets are registered versus merely used in commerce, since unregistered marks are more vulnerable to a competitor's use in another region.

Information Protection Measures

Effective proprietary-information protection combines several layers:

Classification and marking -- labeling documents and systems by sensitivity so employees know handling requirements at a glance.

Access control -- restricting proprietary information to personnel with a demonstrated need to know, both physically (locked file rooms, badge-restricted areas) and logically (role-based system permissions).

Non-disclosure agreements (NDAs) -- contractual obligations, either unilateral (one party discloses) or mutual (both parties disclose), that define what constitutes confidential information, the receiving party's obligations, the duration of the obligation, and remedies for breach. NDAs are signed with employees at hire, with vendors and contractors before information sharing, and often again at termination to reinforce ongoing obligations.

Data management practices -- encryption, secure storage, and controlled destruction of proprietary records at end of life, coordinated with the destruction practices covered elsewhere in the information security program.

Physical access systems -- the same badge, visitor-management, and surveillance controls used for general physical security, applied specifically to R&D labs, executive offices, and other locations where proprietary information concentrates.

A well-drafted NDA specifies several elements the exam expects candidates to recognize: a precise definition of confidential information (avoiding an overbroad, unenforceable scope), carve-outs for information already public or independently developed, a defined term for which confidentiality survives after the relationship ends, and a remedies clause addressing injunctive relief, since monetary damages alone are often inadequate once a trade secret has been disclosed.

Insider Threat to Intellectual Property

Employees and trusted insiders -- not external hackers -- are the most common source of intellectual property loss, because insiders already possess the access that external attackers must work to obtain. The highest-risk window is typically the departure period : an employee who has resigned, been terminated, or is under performance pressure may copy proprietary files before their access is revoked. Effective insider-threat programs combine three elements:

Behavioral indicators -- unusual login times, access to systems outside normal job scope, and bulk downloads or transfers to removable media or personal cloud accounts.

Technical monitoring -- data-loss-prevention (DLP) tooling and user-behavior analytics that flag anomalous access or exfiltration in real time, rather than relying solely on after-the-fact discovery.

Offboarding procedure -- immediate access revocation, device/media return, and an exit interview reinforcing the ongoing NDA and non-compete obligations that survive employment.

A security program that relies only on preventive measures -- training and signed NDAs -- without technical detection capability will typically discover IP theft only after the information has already left the organization, which is why insider-threat monitoring is treated as a distinct, necessary control rather than a redundant one. The CPP exam expects candidates to pair every preventive measure (NDA, marking, training) with a corresponding detective measure (monitoring, audit, access review) rather than relying on prevention alone.

Privileged accounts deserve particular scrutiny: administrators and other high-access roles can bypass many standard controls, so a mature program layers periodic access reviews -- confirming that granted permissions still match current job duties -- on top of the initial need-to-know grant, revoking access that has accumulated beyond what the role requires, a pattern sometimes called privilege creep.