This is one of our most frequent calls from business owners or management. Just such a scenario has been dubbed the “insider threat”. For starters, I encourage the initial documentation of the conditions surrounding the departure, ranging from mental impressions at the moment of their termination (voluntary or non) to the practical side including itemizing company assets used that should be investigated (smartphones, laptops and cloud data). Recent projects worked on, discussions had with current employees who are forthcoming and information from other outside sources (clients calling you to let you know that “John” called representing another company) are important initial pieces that could prove crucial to an ensuing investigation into intellectual property data theft.
Initial steps should also include securing data sources that they might have access to remotely (VPN access, email accounts, online storage drives and ERP-Enterprise Resource Planning systems) to prevent either further access or data destruction.
Following posts will outline next steps such as how to properly document the gathering of evidence and when you should let outside investigators and/or attorneys intervene. #InsiderThreat