If a valuable design was copied, a backup couldn't undo it.

Manufacturers can lose value in more than one way:

• Availability: A design, specification or process record is unavailable when needed for production.
• Confidentiality: An unauthorised person obtains a copy of commercially important information.
• Integrity: A drawing, bill of materials or quality record is altered, and the wrong version is used.

Recovering a file can help with availability. It does not automatically undo unauthorised copying or guarantee that the original information is correct.

Takeaway: Your most valuable information needs clear ownership, appropriate sharing rules and evidence that those rules work.

Independent research commissioned by the UK government estimated £1bn to £8.5bn in UK-wide losses associated with cyber-related intellectual property and knowledge-asset theft in 2024. It is a wide, modelled national estimate, not the likely loss for your organisation.

The research describes how serious theft could undermine an SME's competitive position, especially if confidential know-how is used to develop rival products.

The right question isn't "How much of that £8.5bn would we lose?" It is "Which information would be costly or impossible to replace if someone outside the business obtained it?"

Typical manufacturing examples: product drawings, CAD models, proprietary formulas, manufacturing methods, test results, customer specifications, supplier prices, tender responses, prototype data and quality evidence.

Step 1: Choose one collection. Use a generic label such as "Current product drawings" or "Customer technical specifications". Do not enter, attach or upload confidential content.

Step 2: Identify its owner and value. Who is accountable for sharing decisions? Which products, contracts, customer requirements or competitive advantages depend on it?

Step 3: Trace where it lives. Shared drive, SharePoint/Teams, CAD/PDM/PLM platform, email, supplier portal, removable media or another system. Record only the systems you know about. A manufacturing file estate is not automatically all in Microsoft 365.

Step 4: Map access. Which internal teams, former employees, contractors, suppliers or customers can access it? Who can share, download or synchronise a copy? Are anonymous links permitted? Is external access periodically reviewed?

Step 5: Examine evidence. When were user permissions, external links and supplier accounts last reviewed? Can access be removed promptly? Can the organisation see or investigate material sharing activity where appropriately configured?

Step 6: Check the exit path. What happens when a supplier finishes work, a contractor leaves or an employee changes role? Who revokes access and checks for outstanding links, copies and accounts?

For each question select: Tested / Documented but not verified / Unknown. Add a named owner and the evidence to obtain next. An "unknown" is an action, not a failing grade.

The project ended. The access didn't.

Illustrative scenario, not a claim about an Assured Digital customer: An engineering company shares a set of drawings with a contractor for a six-week design project. The project finishes, but the external account and shared link remain active. Months later, nobody is sure who can still obtain the files or whether local copies were downloaded.

Questions worth settling:

1. Who approved the original access, and for how long?
2. Can the current access list and active links be produced?
3. Can access be restricted or revoked without delaying legitimate supplier work?
4. Does the contract address retention, deletion and onward sharing of copies?
5. Who investigates suspected misuse or disclosure?

Key insight: An access-control change can reduce future exposure, but it cannot automatically recall copies already made. Supplier contracts, process, technology and response planning must work together.

Use a layered review, not a product-shopping list:

• Identity and access: Least privilege, timely deprovisioning, appropriate MFA and supplier account management.
• Information visibility: Know where valuable files are stored and how they move internally and externally.
• Sharing controls: Consider time-limited links, controlled external sharing, permissions and appropriate restrictions on downloading.
• Information classification and protection: Identify data deserving stronger handling; consider Microsoft Purview or other controls where appropriate to environment and licences.
• Evidence and response: Understand available logs, incident-handling steps, contractual duties and who owns the decision to notify affected parties.
• Availability and integrity: Retain appropriate backups, versioning and recovery tests. These address different risks from confidentiality.

Important: None of these controls guarantees that information cannot be copied. Microsoft Purview capabilities depend on licensing, configuration and the type/location of data. An assessment must not imply controls have been deployed or validated without evidence.

Selected information asset: [Generic name]
Why it matters commercially: [Products, contracts, customer commitments]
Named business owner: [Owner]
Systems/location: [Known locations]
External users or supplier groups: [Known / Unknown]
Last access review: [Date / Unknown]
Evidence for permissions, sharing and revocation: [Tested / Documented / Unknown]
Potential consequences requiring separate assessment: [Loss of confidentiality | Product integrity | Contractual impact | Competition | Recovery]
Three checks for the next 30 days: [Action, owner, evidence, due date]

A useful review might end with better ownership of supplier access, changes to sharing practice, a specific Microsoft identity or information-governance control, improved monitoring, or a joint exercise with the current IT provider.

If you identify a defined question about Microsoft 365, identity, information governance, security or recovery, Matthew can discuss whether Assured Digital has a suitable scoped service. We don't claim that a single platform makes IP theft impossible, and we won't ask you to upload sensitive files to make first contact.

Can we review confidential designs without uploading them? Yes. Use generic labels and evidence of access. Never upload drawings, personal data or trade secrets to a marketing resource.

Do we need Microsoft 365? No. The review is technology-neutral. Microsoft controls are one possible implementation area if relevant.

Is this a data-loss prevention audit? No. It's a first-step evidence worksheet, not a technical validation or certification.

How is this different from a backup review? Backups support availability and recovery; access, sharing and response controls address confidentiality and integrity.

Can our existing IT provider use this? Yes. It should help the information owner and the provider agree what evidence is available and what still needs checking.

---