Reducing Information Sharing Risks

Policy

* Segmentation—The basic foundation for protecting confidential data is the classic technique used by the military to protect secrets, classifying data according to its confidentiality and giving access only on a "need to know" basis. For example, a supplier designing a component that fits in your product usually only needs to know the physical envelope (attachment points and constraints) and electrical interface characteristics for their component, rather than receiving your entire design.

* Actionable Information—A promising approach is to scrub data into actionable information. Structured contracts, described in last month's issue (Parallax View), are a good example. Instead of sharing range forecasts, companies express future demand via structured contract terms like minimum firm commitments, lead times guarantees with different pricing for different lead times, capacity guarantees for upside flex at a higher price, etc.

* Escrow Account—At least one company had success with another creative approach; establishing an escrow account that is used if either party violates the agreement. The money is then reinvested in the relationship to fix the cause of the problem, for example, joint team education, fixing flawed processes, or new technology. This dramatically improved the level of trust in that relationship.

Process

It is critical that the policies are backed up by processes and controls to prevent, detect, and correct accidental or deliberate misuse of confidential information, such as:

* Physical Security—Controlled access to offices, receptionist diligence on who is allowed in the building, badges, questioning unknown people in sensitive areas, not leaving confidential documents out in the open, etc.

* Separation and Rotation of Duties—For example, having a different person control physical inventory than the one controlling information about that inventory.

* Training and Testing—Training employees on the procedures and importance of protecting confidential information (yours and other's under NDA). Testing awareness and taking corrective steps.

* Logs—Keeping accurate, tamper-proof records of who accessed what areas, what information, and when.

* Audits—Auditing your firm and trading partners to ensure safeguards and proper training. Some companies have computer-assisted "continuous auditing" of compliance. Particularly sensitive data may require structural organizational safeguards as well. For example, some engineering organizations establish a "clean room" approach that separates the people receiving the highly sensitive design information and restricts their interactions and communications with the rest of their engineering organization to prevent the partner's design information from leaking into their own proprietary designs.

Performance

Policy and process decisions must weigh trade-offs based on business performance impact:

* Business value of sharing information

* Cost of implementing proposed controls

* Consequences of compromising the information

Building Strategic Relationships

A clear distinction should be made between strategic partnerships and more tactical commodity vendor-buyer relationships. Building strategic relationships takes time and diligence and can only be done with a small, rationalized set of suppliers. Done right, suppliers become an extension of the enterprise. This requires methodically laying out an agreement on what will be shared, the benefits, as well as the consequences of breach—building an understanding of the mutual self-interest and interdependence of the relationship. Because traditional relationships are adversarial, it takes a lot of time to change mindsets.

Many companies use the quarterly business review, generally under strict nondisclosure agreements, as the primary forum for sharing confidential strategies. These planning sessions at a senior-executive-to-senior-executive level review things like the changes to market assumptions, scenarios, product roadmaps and transitions (strategy, timing, risks), and supplier performance (goals, actuals, and improvement plans). There are occasional instances where a trading partner abuses this position of trust, but the end result is usually bad for the abuser. For example, a CPG company planned a major promotion with one of its retailers. A week before the planned promotion, the manufacturer did a promotion on the same exact product at a lower price with one of the retailer's competitors. As a result of that breach of trust, the supplier lost business and took years to rebuild its standing with that major retailer. In another instance, a supplier of a component under severe allocation leaked information to one of its customers about a second customer's volumes and mix, in an effort to demand higher prices. The second customer eventually found out and fired the supplier.

Confidential dialogs can be even more challenging when the supplier or customer is also your competitor. Even with a nondisclosure agreement, the sharing of product strategies, roadmaps, and other confidential data is uncomfortable, though it is done every day. Many of the large diversified conglomerates that are likely to be both competitors and trading partners are in the Far East where IP rights are not as strongly upheld. Another twist is that as more and more manufacturing is outsourced to China and elsewhere, it raises the issue of sharing product and manufacturing knowledge with companies that could potentially become competitors of yours. Giant bicycle, founded in 1972 as a contract manufacturer for Schwinn and others, used the knowledge it learned from its customers about manufacturing and designing bicycles to build its own brand. Giant is now the largest bicycle manufacturer in the world and 70 percent of its revenue is from its own brand. A number of electronic contract manufacturers and ODMs are following this same path.