1. Purpose
The Intellectual Property Protection Policy establishes the organization’s requirements for protecting intellectual property (IP) owned by the organization, entrusted to the organization by customers or third parties, or created by employees, contractors, and other authorized personnel.
The objective is to ensure that intellectual property is:
- Identified and appropriately classified
- Owned and used in accordance with applicable agreements
- Protected against unauthorized access, use, disclosure, copying, alteration, or loss
- Used only for authorized business purposes
- Protected throughout its lifecycle
- Properly licensed where third-party IP is used
- Returned, transferred, archived, or securely disposed of when required
- Supported by appropriate contractual and technical controls
Core Principle
Identify → Classify → Establish Ownership → Restrict Access → Protect → Monitor → Review → Return/Dispose
2. Scope
This policy applies to:
- Employees
- Contractors
- Consultants
- Interns
- Temporary personnel
- Developers
- Administrators
- Business partners
- Suppliers
- Other third parties with access to organizational IP
It applies to IP stored or processed in:
- Corporate systems
- Cloud environments
- Source-code repositories
- Developer workstations
- SaaS platforms
- Collaboration platforms
- Databases
- File storage
- Customer environments
- Physical records
- Removable media
- Backup systems
3. Intellectual Property Covered
The organization may hold or manage various forms of IP.
Software and Technology
☐ Source code
☐ Object code
☐ Scripts
☐ APIs
☐ Infrastructure-as-Code
☐ Automation
☐ Algorithms
☐ Software architecture
☐ Technical designs
☐ Configuration templates
Business Information
☐ Business processes
☐ Operating procedures
☐ Methodologies
☐ Internal frameworks
☐ Research
☐ Business plans
☐ Product roadmaps
☐ Pricing models
☐ Strategic information
Creative and Documentation Assets
☐ Documentation
☐ Reports
☐ Presentations
☐ Training material
☐ Designs
☐ Graphics
☐ Website content
☐ Marketing material
Intellectual Property Rights
☐ Copyright
☐ Trademark
☐ Patent
☐ Trade secret
☐ Know-how
☐ Database rights where applicable
☐ Design rights where applicable
4. Policy Statement
The organization shall take reasonable and proportionate measures to protect its intellectual property and intellectual property entrusted to it by customers or third parties.
Intellectual property shall be:
- Accessed only by authorized individuals
- Used only for legitimate business purposes
- Protected according to its classification and sensitivity
- Stored using approved systems
- Shared only with authorized recipients
- Protected against unauthorized copying or disclosure
- Subject to appropriate contractual protections
- Managed according to applicable legal and licensing requirements
5. Intellectual Property Ownership
The organization shall identify ownership of material IP.
Ownership may belong to:
- The organization
- An employee
- A contractor
- A customer
- A supplier
- An open-source project
- Another third party
- Joint owners
Ownership shall be determined based on applicable:
- Employment agreements
- Contractor agreements
- Customer contracts
- Licensing agreements
- Assignment agreements
- Statements of Work
- Other applicable legal arrangements
Important
Ownership should not be assumed solely because information or software is stored on organizational systems.
6. Employee and Contractor IP
Employment and contractor agreements should address IP ownership where appropriate.
Where applicable, agreements should address:
☐ Work-product ownership
☐ IP assignment
☐ Confidentiality
☐ Inventions
☐ Source code
☐ Documentation
☐ Customer deliverables
☐ Pre-existing IP
☐ Third-party/open-source materials
☐ Post-employment obligations
Legal review should be obtained where ownership or assignment requirements are significant or jurisdiction-specific.
7. Pre-Existing Intellectual Property
Personnel should identify relevant pre-existing IP before contributing to organizational projects where ownership could become unclear.
Examples include:
- Previously developed software
- Personal libraries
- Frameworks
- Templates
- Algorithms
- Documentation
- Designs
- Tools
Where pre-existing IP is incorporated into an organizational or customer deliverable, ownership and licensing arrangements should be documented.
8. Customer Intellectual Property
Customer-owned IP shall be treated according to contractual requirements.
Examples include:
- Customer source code
- Customer documentation
- Customer data
- Customer designs
- Customer trademarks
- Customer business information
- Customer-developed software
- Customer credentials
- Customer architecture
☐ Customer ownership identified
☐ Contractual restrictions reviewed
☐ Access limited
☐ Use limited to authorized purposes
☐ Copying restricted
☐ Transfer restrictions understood
☐ Return/deletion requirements identified
9. Third-Party Intellectual Property
Before using third-party IP, personnel should determine:
- Who owns it
- What license applies
- What use is permitted
- Whether modification is permitted
- Whether commercial use is permitted
- Whether attribution is required
- Whether redistribution is permitted
- Whether source-code disclosure obligations exist
- Whether additional contractual restrictions apply
Third-party IP shall not be used merely because it is publicly available.
10. Open-Source Software
Open-source software may be used where permitted by the organization’s approved process.
Personnel should:
☐ Identify the component
☐ Identify the license
☐ Verify license terms
☐ Record the component where required
☐ Assess compatibility with intended use
☐ Track material dependencies
☐ Review security vulnerabilities
☐ Meet attribution requirements
☐ Meet source-distribution requirements where applicable
☐ Obtain approval for restricted licenses where required
Important
Open-source software is not automatically free of legal, security, or licensing obligations.
11. Software Dependency and License Management
For software products, the organization should maintain appropriate visibility into:
- Open-source dependencies
- Commercial software
- Third-party libraries
- SDKs
- APIs
- Containers
- Packages
- Development tools
Where appropriate, maintain:
- Software Dependency Inventory
- SBOM
- License records
- Vulnerability records
- Approval records
12. Source Code Protection
Source code shall be protected against unauthorized access, modification, copying, or disclosure.
Controls should include, as appropriate:
☐ Approved source-code repositories
☐ Individual user accounts
☐ MFA
☐ Least privilege
☐ Branch protection
☐ Pull-request review
☐ Access reviews
☐ Audit logging
☐ Repository monitoring
☐ Backup
☐ Secure development practices
☐ Secrets protection
☐ Restricted public repositories
Source code shall not be published publicly unless explicitly authorized.
13. Source-Code Repository Security
Repositories should be configured according to organizational security requirements.
Where appropriate:
- Require MFA
- Restrict administrative access
- Use role-based permissions
- Protect production branches
- Require code review
- Monitor repository changes
- Protect CI/CD credentials
- Prevent secrets from being committed
- Review external collaborators
- Remove access promptly during offboarding
14. Secrets and Credentials
Passwords, API keys, tokens, private keys, certificates, and other secrets shall not be embedded in source code or stored in inappropriate locations.
☐ Approved secrets-management system
☐ Access restricted
☐ Secrets rotated
☐ Compromised secrets revoked
☐ Repository scanning where appropriate
☐ Logging and monitoring
☐ Secure backup where required
Examples include:
- AWS access keys
- API tokens
- Database credentials
- SSH keys
- OAuth secrets
- Encryption keys
15. Intellectual Property Classification
IP should be classified according to the organization’s information-classification scheme.
Example:
| IP Type | Suggested Classification |
|---|---|
| Public marketing content | Public |
| Internal documentation | Internal |
| Product roadmap | Confidential |
| Proprietary source code | Restricted |
| Encryption keys | Restricted |
| Customer source code | Confidential/Restricted |
| Security architecture | Confidential/Restricted |
| Trade secrets | Restricted |
The actual classification should follow the organization’s approved classification scheme.
16. Access Control
Access to IP shall follow:
Business Need → Authorization → Least Privilege → Access → Monitoring → Review → Revocation
Personnel should receive only the access necessary for their role.
☐ Named accounts
☐ Role-based access
☐ Least privilege
☐ MFA
☐ Privileged access controls
☐ Access approval
☐ Periodic review
☐ Immediate revocation when required
17. Remote Access
Remote access to organizational IP shall use approved security mechanisms.
☐ Approved devices
☐ Strong authentication
☐ MFA
☐ Secure network connection
☐ Endpoint security
☐ Encryption
☐ Access logging
☐ Device security
Personnel should not download restricted IP to unmanaged or unauthorized devices.
18. Intellectual Property Sharing
Before sharing IP externally:
☐ Recipient identified
☐ Business purpose confirmed
☐ Ownership confirmed
☐ Classification reviewed
☐ Authorization obtained
☐ NDA reviewed where applicable
☐ Contract reviewed
☐ Minimum necessary information identified
☐ Secure transfer method selected
☐ Access restrictions applied
19. Customer Deliverables
Before delivering software, documentation, reports, designs, or other IP to customers:
☐ Ownership confirmed
☐ Contractual rights reviewed
☐ Third-party components identified
☐ Open-source obligations reviewed
☐ Customer-specific restrictions checked
☐ Confidential information reviewed
☐ Security review completed where appropriate
☐ Delivery method approved
20. Intellectual Property in Cloud Environments
Where IP is stored in cloud services:
☐ Cloud provider identified
☐ Data/IP location understood
☐ Access controls configured
☐ MFA enabled
☐ Encryption assessed
☐ Logging enabled
☐ Backup configured where required
☐ Sharing permissions restricted
☐ Public exposure reviewed
☐ Access periodically reviewed
AWS Example
For proprietary software hosted on AWS:
- IAM controls access
- MFA protects privileged identities
- S3 permissions restrict stored artifacts
- KMS protects encryption keys
- CloudTrail records relevant activity
- Security monitoring detects suspicious activity
- Backup protects critical repositories and data
21. Intellectual Property in SaaS Platforms
Approved SaaS services used to store or process IP should be assessed according to risk.
Examples:
- GitHub/GitLab
- Project management tools
- Document platforms
- Design platforms
- Collaboration tools
- Cloud storage
- AI platforms
Before using a SaaS platform for Restricted or Confidential IP:
☐ Supplier assessed
☐ Security controls reviewed
☐ Data location considered
☐ Access controls reviewed
☐ Contract reviewed
☐ Subprocessors considered
☐ Data retention assessed
☐ Exit/deletion capability considered
22. Generative AI and Intellectual Property
Personnel shall not submit Restricted, Confidential, customer-owned, or otherwise protected IP to public or unapproved AI services unless explicitly authorized.
Before using AI with organizational IP, assess:
☐ AI provider
☐ Data usage
☐ Training/use of submitted data
☐ Data retention
☐ Data location
☐ Confidentiality
☐ Customer restrictions
☐ Contractual restrictions
☐ Intellectual-property implications
☐ Security controls
Examples of information requiring particular care:
- Source code
- Customer data
- Product roadmaps
- Security architecture
- Proprietary algorithms
- Trade secrets
- Credentials
- Confidential contracts
23. Trademarks and Branding
Organizational trademarks and branding should be protected from unauthorized use.
☐ Trademark ownership recorded
☐ Approved logos maintained
☐ Brand guidelines established
☐ Authorized use defined
☐ Third-party usage controlled
☐ Domain names monitored where appropriate
☐ Unauthorized use reported
Personnel should not create or publish material using organizational trademarks without appropriate authorization.
24. Copyrighted Material
Personnel shall respect copyright requirements when using:
- Images
- Documents
- Software
- Videos
- Training material
- Articles
- Music
- Graphics
- Code
- Templates
Before using third-party copyrighted material:
☐ Ownership identified
☐ License identified
☐ Usage rights confirmed
☐ Attribution requirement reviewed
☐ Modification rights reviewed
☐ Distribution rights reviewed
25. Intellectual Property in Marketing
Marketing teams should verify the rights associated with:
- Images
- Customer logos
- Testimonials
- Case studies
- Screenshots
- Product content
- Third-party content
Customer names, logos, testimonials, or confidential information shall not be used publicly without appropriate authorization.
26. Research and Development
R&D activities involving potentially valuable IP should be appropriately protected.
☐ Project ownership identified
☐ Contributors recorded
☐ Confidentiality requirements established
☐ Source code protected
☐ Research records protected
☐ Third-party IP reviewed
☐ Open-source components reviewed
☐ Inventions identified where relevant
27. Intellectual Property Records
Where appropriate, maintain records of:
- Registered trademarks
- Patents
- Copyrights
- Source-code repositories
- Software licenses
- Open-source dependencies
- Customer-owned IP
- Third-party licenses
- IP assignments
- Relevant contracts
- Invention records
28. Intellectual Property Register
Where appropriate, maintain an IP register.
| IP ID | IP Type | Description | Owner | Classification | Location | License/Contract | Status |
|---|---|---|---|---|---|---|---|
| IP-001 |
29. IP Incident Management
Suspected unauthorized use, disclosure, copying, theft, or loss of IP shall be reported.
Examples include:
- Source code published publicly
- Unauthorized repository access
- Customer code copied
- Proprietary documents sent externally
- Trade secret disclosure
- Unauthorized AI submission
- Unauthorized use of third-party IP
- License violation
- Lost device containing restricted IP
The event should be assessed under the organization’s security incident-management process where appropriate.
30. Suspected IP Breach Response
When an IP protection incident is identified:
- Report the event.
- Record the incident/event.
- Determine the affected IP.
- Identify affected systems and individuals.
- Preserve relevant evidence.
- Restrict or revoke unauthorized access.
- Determine whether information was copied or disclosed.
- Assess customer/third-party impact.
- Assess contractual and legal implications.
- Notify appropriate internal stakeholders.
- Remediate the cause.
- Rotate credentials or secrets where required.
- Assess notification requirements.
- Track corrective actions.
- Document closure.
31. Third-Party IP Incident
Where third-party IP is involved:
☐ Identify owner
☐ Review contractual obligations
☐ Preserve evidence
☐ Notify responsible business owner
☐ Engage legal counsel where appropriate
☐ Assess customer impact
☐ Assess supplier impact
☐ Determine notification requirements
☐ Track corrective actions
32. Employee Offboarding
When personnel leave the organization:
☐ Source-code access revoked
☐ Cloud access revoked
☐ SaaS access revoked
☐ Repository access revoked
☐ VPN access revoked
☐ Collaboration access revoked
☐ Customer-system access revoked
☐ Company devices recovered
☐ Organizational information returned
☐ Unauthorized copies addressed
☐ Confidentiality obligations reviewed
☐ Secrets/credentials rotated where necessary
Access revocation should be completed according to the organization’s access-management process.
33. Contractor Offboarding
Contractor termination should include:
☐ Access review
☐ Repository access removal
☐ Cloud access removal
☐ Customer access removal
☐ Asset return
☐ Information return/deletion
☐ Confidentiality obligations reviewed
☐ Third-party credentials addressed
☐ IP ownership records updated
34. Intellectual Property Return and Disposal
When IP is no longer required:
☐ Retention requirement assessed
☐ Contractual requirement assessed
☐ Legal hold considered
☐ Customer return requirement assessed
☐ Secure deletion performed where required
☐ Copies addressed
☐ Backup copies considered
☐ Disposal evidence retained where appropriate
35. Legal and Contractual Protection
Where appropriate, IP protection should be supported through:
☐ Employment agreements
☐ Contractor agreements
☐ NDA
☐ Customer contracts
☐ Supplier agreements
☐ IP assignment agreements
☐ Licensing agreements
☐ Security agreements
☐ Data-processing agreements
Legal terms should be reviewed by appropriately authorized legal personnel.
36. IP Risk Assessment
Significant IP should be assessed for risks such as:
- Unauthorized disclosure
- Unauthorized copying
- Theft
- Loss
- Unauthorized modification
- License violation
- Ownership dispute
- Third-party infringement claim
- Customer contractual breach
- Insider misuse
- Supplier compromise
- Cloud exposure
- AI-related disclosure
| IP/Risk | Threat | Vulnerability | Impact | Risk | Control | Treatment |
|---|---|---|---|---|---|---|
37. Compliance and Licensing Review
Verify:
☐ Applicable IP laws identified
☐ Licensing obligations identified
☐ Third-party licenses reviewed
☐ Open-source licenses reviewed
☐ Customer contractual requirements reviewed
☐ IP assignment requirements reviewed
☐ Trademark requirements reviewed
☐ Copyright requirements reviewed
☐ Patent requirements reviewed where applicable
38. Monitoring and Review
The organization should periodically review:
☐ IP register
☐ Repository access
☐ Privileged access
☐ External collaborators
☐ Open-source dependencies
☐ Software licenses
☐ Customer IP arrangements
☐ Third-party licenses
☐ Cloud storage permissions
☐ SaaS sharing settings
☐ IP incidents
☐ Legal/contractual changes
39. Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Management | Approves policy and significant IP decisions |
| Legal | Advises on ownership, licensing, infringement and legal obligations |
| Security | Protects IP through security controls |
| Engineering | Protects source code and technical IP |
| HR | Addresses employee/contractor agreements and offboarding |
| Procurement | Reviews supplier licensing and IP terms |
| Business Owner | Determines legitimate business use |
| Compliance | Monitors relevant obligations |
| Employees | Protect IP and report suspected misuse |
| Supplier Owner | Manages third-party IP relationships |
40. Exceptions
Any exception to this policy should be:
☐ Documented
☐ Risk assessed
☐ Approved by authorized personnel
☐ Time-bound where practical
☐ Supported by compensating controls where appropriate
☐ Periodically reviewed
41. Policy Violations
Violations may include:
- Unauthorized source-code disclosure
- Unauthorized copying
- Unauthorized external sharing
- Use of unlicensed software
- Circumvention of license restrictions
- Submission of protected IP to unauthorized AI services
- Unauthorized use of customer IP
- Public exposure of restricted IP
- Failure to report an IP incident
Violations may result in:
- Access restriction
- Corrective action
- Contractual action
- Disciplinary action
- Legal action
Any action should follow applicable law, contracts, and organizational procedures.
42. Awareness
Relevant personnel should receive appropriate awareness regarding:
- IP protection
- Confidentiality
- Source-code security
- Open-source licensing
- Third-party IP
- Customer IP
- AI usage
- Secure sharing
- Offboarding
- Incident reporting
43. AWS SaaS Startup Example
A SaaS startup develops a proprietary application hosted on AWS.
Intellectual Property
The startup’s IP includes:
- Application source code
- Database schema
- API design
- Infrastructure-as-Code
- CI/CD pipelines
- Security architecture
- Product roadmap
- Internal methodologies
Protection
Git repository
- MFA
- Individual accounts
- Branch protection
- Code review
- Restricted administrative access
AWS
- IAM least privilege
- MFA
- KMS encryption
- CloudTrail
- Restricted S3 access
- Security monitoring
CI/CD
- Protected credentials
- Secrets management
- Restricted deployment permissions
- Audit logging
AI Tools
Developers are prohibited from submitting proprietary source code to unapproved public AI tools.
Offboarding
When a developer leaves:
Repository Access Revoked → AWS Access Revoked → CI/CD Access Revoked → SaaS Access Revoked → Device Returned → Secrets Reviewed/Rotated → IP/Confidentiality Obligations Confirmed → Evidence Recorded
44. Startup-Friendly IP Protection Model
A startup can establish strong IP protection without creating excessive bureaucracy.
Start with:
1. Know What Your IP Is
Identify:
- Source code
- Product designs
- Customer deliverables
- Trademarks
- Documentation
- Trade secrets
- Proprietary processes
2. Know Who Owns It
Document organizational, employee, customer, supplier, and third-party ownership.
3. Protect Access
Use:
- MFA
- Least privilege
- Named accounts
- Repository controls
- Cloud IAM
4. Control Third-Party Software
Track:
- Open-source components
- Commercial licenses
- Dependencies
- SBOM where appropriate
5. Control AI Usage
Do not submit protected IP to unapproved AI services.
6. Protect Customer IP
Use customer contracts, access controls, confidentiality, and secure transfer.
7. Protect During Offboarding
Immediately revoke access and address copies, devices, credentials, and information.
8. Keep Evidence
Maintain enough evidence to demonstrate that IP protection controls operate.
45. Common Mistakes
Avoid:
- Assuming everything created by an employee automatically belongs to the organization.
- Failing to address IP ownership in contracts.
- Using third-party software without reviewing its license.
- Assuming open-source software has no obligations.
- Allowing unrestricted repository access.
- Storing secrets in source code.
- Sharing customer source code without authorization.
- Uploading confidential source code to public AI tools.
- Allowing former employees to retain system access.
- Ignoring third-party IP restrictions.
- Using customer logos or content without authorization.
- Treating a contract as the only IP protection mechanism.
- Failing to maintain evidence of ownership or licensing.
46. Relationship With Other ISMS Documents
| Document | Relationship |
|---|---|
| Information Classification Policy | Determines protection requirements |
| Access Control Policy | Controls access to IP |
| Acceptable Use Policy | Defines permitted use |
| Secure Development Policy | Protects software IP |
| Supplier Security Policy | Addresses third-party IP |
| Cloud Security Policy | Protects IP in cloud environments |
| Software Dependency Inventory | Tracks third-party software |
| SBOM | Provides software component visibility |
| Third-Party Software Assessment | Assesses external components |
| Information Transfer Procedure | Controls IP sharing |
| Incident Management Policy | Handles IP-related incidents |
| Offboarding Procedure | Removes access |
| Asset Management | Identifies IP-related assets |
| Legal & Regulatory Requirements Register | Tracks applicable legal requirements |
| Contractual Security Requirements Register | Tracks contractual IP commitments |
47. ISO/IEC 27001 Connection
Intellectual property protection supports the organization’s ISMS by protecting information and technology assets from unauthorized access, use, disclosure, modification, or loss.
It can support areas including:
- Information classification
- Access control
- Asset management
- Information transfer
- Supplier relationships
- Secure development
- Cloud security
- Confidentiality
- Data protection
- Incident management
- Legal and contractual requirements
- Information deletion
- Offboarding
This policy is an organizational policy template and is not itself a universally mandatory ISO/IEC 27001 document.
The organization should determine the appropriate IP protection controls based on:
- Information-security risk
- IP ownership
- Business requirements
- Customer requirements
- Contracts
- Applicable law
- Technology environment
48. Audit Evidence
Appropriate evidence may include:
- IP register
- Employment agreements
- Contractor agreements
- NDA
- IP assignment agreements
- Software license records
- Open-source inventory
- SBOM
- Repository access reviews
- IAM access reviews
- MFA configuration
- Code-review records
- Secrets-management evidence
- Cloud configuration
- Customer contracts
- Third-party licenses
- AI usage approvals
- Offboarding records
- IP incident records
- Corrective actions
- Risk assessments
Evidence should be proportionate to the sensitivity and value of the IP.
49. Final IP Protection Audit Trail
For significant organizational or customer IP:
IP Identified
↓
Ownership Established
↓
Classification Assigned
↓
Risk Assessed
↓
Access Authorized
↓
Security Controls Implemented
↓
Third-Party/Licensing Requirements Reviewed
↓
Use Monitored
↓
Access Periodically Reviewed
↓
Incident/Unauthorized Use Investigated
↓
Access Revoked When Required
↓
IP Returned/Deleted/Retained as Required
↓
Evidence Maintained
50. Final Principle
Intellectual property protection is not simply preventing source code from being stolen.
It is the controlled management of what the organization owns, what others own, what the organization is permitted to use, who can access it, how it is protected, how third-party licensing is managed, and what happens when the relationship or business need ends.
Final Principle
Identify → Establish Ownership → Classify → Assess Risk → Authorize Access → Protect → Control Use → Monitor → Review → Revoke → Return/Delete → Preserve Evidence