Before e-discovery begins, a law firm should know where potentially relevant information lives, who can access it, how it will be preserved, and how every collection decision will be documented. Reviewing these IT controls before a matter arrives helps teams find practical gaps while there is still time to address them. In plain terms, what it controls should a law firm review before e discovery? Start with data ownership, preservation, access, collection, and oversight.
Discuss IT support for your law firm
What does an e-discovery control review cover?
E-discovery involves electronically stored information (ESI), such as email, documents, chat messages, mobile-device data, and files held in cloud services. The technology review is not a substitute for an attorney’s decisions about legal duties, relevance, privilege, or production. Instead, it checks whether the firm’s systems and operating procedures can support the legal team’s decisions in a consistent, traceable way.
Begin by mapping the path information takes: where it is created, where it is stored, how it is backed up, who administers it, and how the firm can preserve or collect it. Include systems the firm controls directly and services managed by outside providers. For background on preservation and related issues, see the University of South Carolina law library’s e-discovery guide. The New York State Bar Association’s e-discovery best-practices resource also discusses the challenges of handling electronically stored information and privilege review.
A useful boundary is to separate legal decisions from technical execution. The attorney or legal team defines the matter, custodians, scope, and any legal instructions. IT and the relevant vendors identify what systems can hold that information, explain technical options and limitations, and perform authorized steps. Write down who makes each decision so that urgent technical questions do not accidentally turn into legal judgments.
Which data sources should the firm identify?
A reliable review starts with an inventory, not an assumption that all case material is in email or a document-management system. Ask practice-group leaders, records staff, and IT administrators to identify the tools people actually use. Include both approved platforms and workarounds that may have become routine.
- Email and calendars: Identify mailboxes, shared mailboxes, archives, and retention settings. Note whether staff also use personal or secondary accounts for work.
- File storage and collaboration: Record network shares, cloud drives, document-management systems, collaboration sites, and shared workspaces. Capture site owners and administrative access.
- Messaging and conferencing: Identify business chat, text messaging, video meeting, and voice platforms that may contain relevant communications or attachments.
- Endpoints and mobile devices: Determine which laptops, desktops, phones, and removable media may hold work information. Clarify whether the device is firm-owned or personally owned and what access the firm has.
- Business applications: Consider case-management, billing, customer relationship, scanning, and line-of-business systems. A system may store records, audit history, or attachments outside the main file repository.
- Outside services: List cloud providers, e-discovery vendors, consultants, and other parties that host or process firm data. Record who can request preservation or export and how quickly.
For each source, note the business owner, technical administrator, data type, retention behavior, export options, and dependencies. Record the source’s name as employees know it, not only the vendor’s product name. If the firm uses Microsoft 365 services, for example, inventory the particular workloads and shared locations in use rather than treating the entire platform as one undifferentiated store.
Ask a few employees to describe how they handle a typical matter file from receipt to final storage. This simple walkthrough can reveal that an attachment is saved to a local desktop, a client sends messages through a portal, or a team uses a chat channel that does not appear in the formal records map. Confirm these findings with administrators, then assign a named owner to verify each system and its access path. A current spreadsheet with a responsible person and a next action is better than an outdated diagram no one can verify.
How should preservation and retention controls be tested?
Preservation depends on people and systems acting together. A firm should have a documented way to route a preservation instruction to the people who can identify custodians, pause routine deletion where appropriate, and confirm that relevant sources are addressed. Legal counsel determines when a hold is required and its scope; IT supports the technical implementation.
Review these points with the responsible attorneys and administrators:
- Hold workflow: Who can issue or approve an instruction? How is it delivered to custodians, supervisors, and IT? How does the firm record acknowledgments and follow up on missing responses?
- Deletion and retention: Which automated policies, mailbox limits, backup cycles, and device settings could affect information? Can responsible staff identify the settings and coordinate a change when counsel directs it?
- Source coverage: Does the hold process prompt staff to consider email, shared files, chat, mobile devices, and relevant third-party platforms, rather than only the most obvious repository?
- Changes over time: What happens when a custodian changes roles, leaves the firm, replaces a device, or moves information? Is there a way to verify that preservation requirements remain assigned?
- Release and return to normal: Who authorizes the end of a hold, and how is that decision recorded before ordinary retention rules resume?
Test the process with a tabletop exercise using a fictional matter. Trace a sample instruction from the attorney to the custodian and IT administrator. Look for missed systems, unclear responsibilities, or steps that rely on one person’s memory. Do not use live client information in an informal test. Give the exercise a realistic sequence: the attorney identifies a matter and custodians; the administrator checks the inventory; the custodian confirms relevant work accounts and devices; IT records any technical changes; and the legal team checks acknowledgments.
For each step, ask what evidence would show that it happened. That might be a dated acknowledgment, a ticket or change record, a list of affected systems, or a confirmation from an outside provider. If a required action depends on a single administrator, identify a backup owner and make sure that person knows how to find the procedure. A short test often exposes a gap that a policy review alone will miss.
Who can access data and collection tools?
Access control is both a security issue and a process-integrity issue. Limit administrative privileges to people who need them, use individual accounts rather than shared credentials where possible, and review access when staff change responsibilities or leave. For sensitive collections, define who may request, approve, perform, and verify the work. Separation of duties can help reduce mistakes and make later questions easier to answer.
Check whether the firm can answer these practical questions: Are multifactor authentication and strong sign-in protections enabled for administrators and remote access? Are access events logged? Can the firm identify who exported a mailbox or changed a retention setting? Are vendor accounts time-limited and removed when work ends? The firm’s broader IT security practices for attorneys should support the same careful access approach.
Do not treat a backup as a complete e-discovery plan. Backups may serve recovery purposes, use different retention periods, or be difficult to search and restore selectively. Confirm what each system is designed to do and what export or preservation options are available. For more on protecting information from accidental loss, review these ways to reduce employee-related data loss.
Check access at more than one point in time. Compare a current staff roster with privileged accounts and vendor access, then ask what happens when a person changes roles or leaves. Verify that account removal does not inadvertently eliminate needed ownership of a shared site or archive. The right process closes unnecessary access while transferring administrative responsibility to an appropriate, documented owner.
Talk with an IT team about law firm systems and controls
What should the firm verify about collection and documentation?
Before a dispute, establish who is permitted to collect information and which tools or vendor processes are approved. The approach may differ by data source. For example, exporting a mailbox, collecting files from a shared site, and preserving data on a mobile device can involve different permissions and technical steps. Have the legal team determine scope and have qualified personnel execute the agreed process.
For each collection, preserve a useful record of the request, source, date and time, person performing the work, method or tool used, scope, exceptions, and destination of the collected material. Record any error or limitation instead of silently working around it. Establish secure transfer and storage procedures, including who can open the collected material and how copies are tracked. These records help the team explain what it did; they do not, by themselves, prove that a collection was complete or legally sufficient.
Use a repeatable collection record that can be completed without guessing. A simple template might include:
- Authorization: The person who requested the work, the approving attorney, and the reference to the instruction.
- Scope: The custodian, source, date range, and data types identified by the legal team.
- Execution: The person who performed the work, date and time, method used, and relevant settings.
- Outcome: The destination, transfer route, any exceptions, and the person who confirmed receipt.
- Follow-up: Open questions, system limitations, or additional instructions that require attorney review.
For instance, if a shared repository contains a folder that the assigned collector cannot access, the record should state that limitation and route it to the appropriate owner. It should not imply that the collection covered the inaccessible material. If a vendor performs work, capture the vendor’s role and handoff points in the same record so the internal file shows the full path from request through receipt.
Ask vendors how they handle access, retention, transfer, and return or deletion of firm data. Confirm who at the firm owns the relationship and who can make an urgent request. Review relevant contract terms with counsel. For a broader look at technology support for legal practices, see the guide to IT services for Tampa law firms and this discussion of outsourced IT for law firms.
Which controls deserve attention first?
Use the table to prioritize a first review. The exact response depends on the firm’s systems, matter, and legal direction; this is a planning aid, not a legal checklist.
| Control area | What to verify | First practical step |
|---|---|---|
| Data inventory | Current sources, owners, administrators, and export paths | Ask each practice group which tools it uses to create, send, and store work information |
| Preservation | Hold routing, acknowledgments, retention changes, and release approval | Walk through a sample hold with counsel and IT |
| Access | Administrative accounts, logging, vendor access, and staff offboarding | Review privileged accounts and remove stale access |
| Collection | Approved roles, source-specific methods, and documented exceptions | Write down who requests, approves, collects, and verifies information |
| Transfer and storage | Secure destinations, permissions, copies, and retention responsibilities | Trace how one sample export would move from source to authorized reviewer |
| Vendor oversight | Contacts, response process, data handling, and end-of-engagement steps | Confirm the vendor contact and escalation route with the relationship owner |
Prioritize a gap by asking what could happen if the firm needed to act quickly. An unknown data location may delay identification; unclear hold ownership may leave staff waiting for direction; missing logs may make it harder to reconstruct an administrative change. This is not a legal ranking of risk. It is a practical way for operations and IT staff to surface issues for the attorneys responsible for decisions.
How can a firm turn the review into an action plan?
Keep the first review focused. For each control, record its current state, evidence checked, gap, responsible owner, and next action. Mark questions that require attorney judgment rather than asking IT staff to decide legal scope. Rank issues by their effect on the firm’s ability to locate, preserve, secure, and explain relevant information.
A short action plan might assign one owner to update the data-source inventory, another to document hold routing, and a third to verify vendor escalation contacts. Make each action specific enough to confirm: for example, replace “review access” with “compare the privileged-account list to the current staff and vendor roster, document exceptions, and assign follow-up.” Add a due date and a reviewer so that actions do not disappear after the meeting.
Set a review date after major system changes, staff changes, or a significant change in how the firm handles matter data. A periodic check should verify that owners still work at the firm, links and contacts remain current, and procedures match the systems employees actually use. Where the firm needs outside support for its wider technology environment, learn about managed IT considerations for Tampa businesses or explore the available service areas.
For a simple starting exercise, bring together one attorney, an IT administrator, a records or operations contact, and the owner of a key outside service. Pick a fictional scenario, map the relevant data sources, and write down the questions the group cannot answer. Turn each unanswered question into an assigned follow-up rather than trying to solve every policy issue in one session.
Call to discuss your law firm’s IT control review
Frequently asked questions
Does IT decide what information is relevant to a case?
No. Attorneys determine legal scope, relevance, privilege, and case strategy. IT personnel help identify systems, preserve or collect information as directed, and document technical steps.
Are backups enough to satisfy preservation needs?
Not necessarily. Backups are generally configured for recovery and may not provide a straightforward way to identify and preserve specific information. The firm should understand each system’s capabilities and follow counsel’s direction for the matter.
How often should a law firm review these controls?
Review them when systems, vendors, staff responsibilities, or data-handling practices change, and periodically as part of the firm’s governance process. A tabletop exercise can reveal whether written procedures still match day-to-day practice.
What is the best place to begin if no inventory exists?
Start with a short list of the systems each practice group uses for email, files, messaging, mobile work, and case management. Add an owner and an administrator for each system, then verify its retention and export options.
What should you do next?
Before the next matter requires urgent action, bring the responsible attorney and IT administrator together to map key data sources, test the hold workflow, and assign owners to any gaps. A clear, documented process gives the legal team a stronger operational foundation for e-discovery decisions.