Define the Legal Discovery Archive

Define the archive by request, custodian and version

A discovery archive should be a defensible working set, not a copy of every case folder. Map each item to a request, custodian, date range and source. Preserve originals elsewhere, identify privileged or excluded material, and record the authoritative version before protection.

Run the control in five steps

1. 01Translate each request into a documented collection scope.
2. 02Identify custodians, systems, date ranges and authoritative sources.
3. 03Separate originals, working copies, privileged material and exclusions.
4. 04Assign stable filenames and version identifiers.
5. 05Obtain counsel approval for the archive manifest.

Preserve a defensible decision trail

Record matter ID, request number, custodian, source system, collection date, filename, version, hash or count, privilege status, reviewer and exclusion reason. The manifest describes the set without copying confidential content.

Stop and investigate when

• The archive contains whole user profiles without a scope decision.
• No one can distinguish originals from derived working copies.
• Privilege or confidentiality status is missing.

State what the control does not prove

Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate preservation, authorization, plaintext copies, provider controls and recovery separately.

Legal discovery security questions

Sources for this decision

• Federal Rules of Civil Procedure: discovery and disclosure
• NIST SP 800-53 Rev. 5: Media Protection

Links support specific control decisions and do not imply endorsement.