Sometimes an organization can feel as if it has done everything right and still fall short when it comes to data protection. No matter what level of security measures you have in place at your organization, you may still face investigations and lawsuits if a known or unknown exposure is identified. As the cliché aptly points out, it’s not a matter of ‘if’, but ‘when’. 

In the last three blogs in our four-part series, we’ve talked about data classification, incident response, and data loss prevention. Having each of these security measures in place not only helps protect your data, but it can also help your company potentially avoid potential litigation, investigations, and regulatory compliance risks. 

In this final post in the series, we will address how to decrease threats, increase compliance, and leverage more sophisticated platforms while simultaneously creating greater cost containment for your company. 
 

How E-Discovery Tools Have Evolved and Why It Is Important to Understand

In contrast to how discovery was handled 20 years ago, today's data discovery journey begins with an emphasis on the Information Governance Reference Model (IGRM), which is incorporated in the broader E-Discovery Reference Model (EDRM) framework. The IGRM includes concepts that were discussed in our previous posts in this series such as data classification, incident response, and data loss prevention. The IGRM provides necessary guidance on how to protect, retain, transfer, and use data that is created and received at every organization. It also provides a model in which the cross-functional business units of IT, security, privacy, risk, RIM, business, and of course, legal, create a unified governance approach. 


E-Discovery Reference Model.” EDRM Model, EDRM, https://edrm.net/edrm-model/

The further upstream you are in the EDRM, you have vastly more data (e.g., more data volume) and less relevant data for purposes of investigations, litigation, and compliance matters. The further downstream you are, the less volume an organization wants to have and the more probative or relevant that data should be for each matter. The costs and expenses tied to any matter have historically been in collecting and preserving the data (usually organizations collect and over preserve too much data), processing that data (typically referred to as “culling” or “early case assessment”), and then leveraging document reviewers to perform the review. These functions not only drive up litigation and investigation costs, but they also drive up the cost of data breach matters where personally identified information (“PII”) is not easily identified, especially in unstructured data.

With technology evolving so quickly, companies are finding that there are new ways to make, collect, and store data. This presents significant challenges when a company knows or reasonably should know that litigation is going to ensue, and they need to preserve relevant custodial data. What’s more, because the volume of data custodians create, it can be difficult to know what information is appropriate to include in a litigation, investigation, or compliance matter. The legacy model was for companies to send the results to their outside counsel or an e-discovery provider that all have disparate security postures that may not necessarily align with that of the company, which can create a security risk.

However, the flipside to this is that by leveraging a company’s internal teams (and potentially augmented by a trusted managed service provider) and the right technology, these challenges can be mitigated. For instance, imagine for a moment that you performed a substantive data mapping model in which the organization now knows who is creating the data (typically called the “custodians”), where they are making the data, the types of data they are creating, and the sources of this data. Take it another step further and imagine that you are able to collect custodian data proportionately to the matter’s needs while simultaneously preserving that data in place. Once there, your organization can then cull the data, eliminate waste, apply analytics, and if need be, export the data to outside counsel or to a trusted E-Discovery Managed Services provider who understands this approach. 

Today, that same task may be accomplished with Microsoft’s Advanced E-Discovery (AeD), which is included as part of the Microsoft M365 E5 suite. This keeps the data more secure by keeping it in-house, depicts data trends, which surfaces up new insights, and simultaneously helps reduce costs and increase security because e-discovery data is no longer leavings its four walls and going to disparate vendors with varying security postures and pricing structures.
 

Creating the Right E-Discovery Data Journey Story for Your Organization

E-Discovery is no longer a mystical and disparate part of a corporation’s data lifecycle, but rather an extension of the desire to manage enterprise information from a security, compliance, and identity management perspective. When done correctly with the right technology, policies, and compliance, e-discovery can be simplified. By the time an investigation, regulatory matter, or litigation ensues, the questions pertaining to data have been minimized.

Corporate legal departments want to know they can search, collect, actively crawl, preserve, and process through information without having to jump through massive hoops. Microsoft’s Advanced E-discovery has become essential for all types of companies who want to have greater control over a time-consuming, costly process. 

Need help getting started with Advanced E-discovery? The specialists at BDO can help. Our e-discovery solution, Athenagy™, is the only patent-pending business intelligence dashboard that surfaces up data transparency by combining the best of both Microsoft 365’s Advanced E-Discovery + RelativityOne so legal professionals can drive business outcomes. For a demo of Athenagy™ or to learn more about our Enterprise E-Discovery Managed Services program, please contact us today