Most security coverage in the biotech sector centers around patent protection. But securing intellectual property (IP) isn't the only type of protection you'll need to worry about when launching a startup. There are all kinds of assets associated with your business—computers, data, biological specimens, reagents, even employees—that you need to safeguard.

The good news is that all elements of your company can usually be identified and protected under one security program.

Taking stock

To begin thinking about protecting your company, you should ask some simple questions about your firm, starting with: What are the threats to your business? Once you've identified these threats, you should move to: What is the probability of these threats occurring? And lastly: What would be the consequences if these threats did occur?

If you're a greenhorn CEO, you probably have put more thought into building assets than into protecting existing ones. From day one, however, there are several tenets you should keep in mind ( Box 1 ). Another way to educate yourself is to examine the risks of a 'like' company—a public firm similar in size and/or focus to the one you are running or hoping to build. Sift through the other company's annual reports for its identified risks, says Anthony Patillo, associate vice president of security in North America at Sanofi-aventis, based in Paris. Compare what you find there with your own company, and you should get a basic idea of what you'll be up against.

That might be enough to put you on the right path to protecting your company, especially if it is small and contained in an academic setting or incubator. But as your firm grows in size and importance (meaning you develop actual products and your IP becomes more valuable), the best thing to do is an official risk assessment, which will help you determine your company's weaknesses. There are several organizations that can help with this, including the International Security Management Association (ISMA), based in Buffalo, Iowa, and the American Society for Industrial Security (ASIS), located in Alexandria, Virginia.

Have discussions with several security experts before deciding whom to hire. Also, use your networking skills—ask other biotech executives whom they have worked with and gauge their level of satisfaction with the results.

The risk assessment will determine the current needs for your company. How you address those varied needs is up to you—you'll have to determine the risk appetite for your particular company, and you'll need to decide what you must absolutely take care of (and pay for) now. As CEO, you'll need to keep in mind that a “big lawsuit might wipe you out,” says Patillo, and balance that against the probabilities of any particular risk actually occurring.

Once the gaps are identified and the company's appetite for risk established, close the gaps with a strategic plan. It should be specific to your company and its goals, but there are two basic aspects that require protection at every company: human and nonhuman assets.

Nonhuman assets

To protect the nonhuman aspects of your company, you'll need to keep track of the humans entering and leaving your building. At the very least, this keeps simple things like chairs from being stolen, but it also means unauthorized people don't enter your lab or access the computers. There's no reason to put at risk valuable data or patent information.

The most effective way of achieving this is by controlling access. If you're in a space leased from an academic institution, or in an accelerator, it's likely this is already taken care of. But if your firm has moved out on its own and has people coming and going, you'll want an identification badge system and/or a closed-circuit television system to monitor the exits. There are dozens of places to turn to online for help, but a good starting point would again be ASIS. (There is a membership fee to join the site, but it's fairly low at less than $200 annually.)

Perhaps you need more than door security—perhaps you need a fence to protect valuable reagents or equipment or biological materials, or maybe you have a pilot plant for producing second-generation biofuels. Either way, the risk assessment will help you identify your needs, and you can make your decisions from there.

The human factor

The most important part of any company is the employees, so protecting them is paramount, both at the office and when they travel ( Box 2 ). Although there are reports of animal rights extremists attacking biotech companies (perhaps most infamously the two pipe bombs that were detonated at Chiron, of Emeryville, California, in 2003, although there were no injuries), history suggests these types of activities are quite rare. Instead, most employees simply need to be protected from their own behavior, says Hamilton Mixon, senior director of risk and global security at Vertex, in Cambridge, Massachusetts.

Partly, this means preventing theft of IP or proprietary information by your employees. How this is actually done, and the systems put in place, will be company specific and generated by your risk assessment.

But there is more to consider here, as employees are also people, leading complex lives and having emotional desires and goals that vary widely. They will interact with each other; it's possible they will have differences of opinions and sometimes even strong dislike for one another. As a founder or executive, you'd do well to consider a program for monitoring and preparing for violence in the workplace. Mixon says the most common occurrence is simple assault. A good program will aim to detect early warning signs of a disgruntled or potentially violent employee, and it will also lay out a plan of appropriate response. It is crucial to stop these types of occurrences before they happen, not only to prevent injury but also because it takes just one violent incident to make others feel unsafe on the job for years to come.

Hired help

Even after programs have been put in place, the issue of oversight remains: Who will monitor all this? The point at which your startup needs a dedicated security person will mostly depend on you and the rest of leadership. You'll need to discuss this with the board and decide if it's time to allocate the resources to the new position. Also, there has to be enough work to keep that new hire busy, so if you're a three-person company in a university space that has its own security, then it's not the time to fill that position.

When the hire is made, that person will work closely with both the human resources department and your legal representation. The job of human resources is to take policies and issues to the staff, hopefully smoothing over any inconveniences caused by implementation. The legal department helps ensure that those involved in any infraction do not have their rights violated and covers your company in terms of liabilities.

All of this comes at a cost, of course, and as a company you'll need to decide what you can spend ( Box 3 ). But once it's in place, it simply needs tweaking to reflect growth. “A small firm with 100 employees will have the same components as a billion-dollar, multinational company,” says Mixon, “but it has to be done to scale.”

Conclusions

Biotech is not crime fighting, and running a small business is not espionage for the government, but you'll need to take certain steps to protect the valuable assets of your company. That begins with a gap/risk assessment that will help you define what type of security program you'll need to put in place.

Acknowledgements

The author is grateful to Hamilton Mixon, Anthony Patillo and Richard E. Widup for insights in drafting this article.