- [Narrator] Cybersecurity professionals
often find themselves called upon
to participate in electronic discovery efforts
that result from legal actions involving their firms.
When organizations are involved in legal disputes,
they have an obligation to preserve evidence
related to that dispute
and produce it in response to a legitimate legal order.
We'll talk about three major steps
in the electronic discovery process:
preservation, collection, and production.
When an organization receives notice
of potential litigation, the first step
they should take is the issuance
of a litigation hold to individuals and departments
that may have electronic or paper records
relevant to the dispute.
This usually takes the form of a memo
sent to those individuals and departments
informing them of the potential litigation
and instructing them that they are required
to preserve any records related to the dispute.
It's important to remember
that preservation includes more
than just not intentionally destroying information.
Once the organization has a reason to believe
that there will be litigation,
they must suspend any automated processes
that would destroy relevant information.
This most often affects IT groups
by requiring the preservation of log entries.
If there are logs relevant to the dispute,
IT staff must ensure that those logs
are preserved and not automatically purged
by a system after a certain period of time
or after the log files reach a certain size.
If the legal dispute progresses,
at some point in the process
the legal team will decide that it is prudent
to begin the collection of preserved electronic records.
It's up to the attorneys to decide when
collection is warranted.
Cybersecurity teams are often called upon
to support collection efforts across many systems.
Some of the sources that may be included
in collection efforts include documents
stored on file servers,
files stored on individual computers,
email messages stored on servers or in the cloud,
and records in enterprise systems
managed on premises or in the cloud.
Organizations must have processes in place
to collect this information
and will normally use an electronic discovery
management system to assist with the collection
and organization of those records.
If the dispute moves forward,
the electronic discovery process
may move to the production phase
where records will actually be provided
to the other side.
If this occurs, the real heavy lifting
of e-discovery begins.
Attorneys will pour over all of the collected records
and decide which are relevant to the dispute
and not protected by legal privileges
such as attorney-client privilege.
After completing this review,
the attorneys will create an electronic file
containing all relevant records
and share it with the other side.
In most organizations the vast majority
of litigation holds never move beyond
the preservation and collection phases.
Unless the business finds itself
in courtrooms on a regular basis,
it's rare to actually produce evidence
to the other side.
Cases often never materialize
or are settled outside of court.
Electronic discovery is an important legal process
that is primarily owned by attorneys,
but cybersecurity professionals
are often called upon to provide technical assistance.