# E-Discovery (EDRM) Backlink: [[Domain 1 - Index]] **Definition:** The Electronic Discovery Reference Model outlines stages for handling electronically stored information (ESI) in legal matters. ## Key Facts - Stages: Info Governance → Identification → Preservation → Collection → Processing → Review → Analysis → Production → Presentation. - Legal hold: preserve relevant ESI; suspend normal deletion. - Scope and proportionality limit burden and cost; protect metadata. - Cross-border issues require privacy/compliance coordination. - **Verify:** check official (ISC)² CBK and current exam outline. >[!tip] **Exam Relevance** - Correct order of stages and legal hold triggers - Handling metadata and avoiding spoliation >[!note] **Mnemonic** - “IP C PR A PP.” ### Example Q: Under legal hold, can auto-deletion continue? A: No—suspend for relevant data. ## Revision Checklist - [ ] Recall EDRM stages - [ ] Define legal hold and spoliation - [ ] Note metadata considerations - [ ] Consider cross-border constraints ## Related [[Evidence Handling and Chain of Custody]] · [[Privacy Principles and Regulations]] · [[Legal Systems and Laws (Civil, Criminal, Administrative)]] · [[Data Retention and Destruction]] · [[Incident Response Lifecycle]] #cisSP #domain-1 #concept