2 cissp ® Official Study Guide Eighth Edition

Electronic Discovery
In legal proceedings, each side has a duty to preserve evidence related to the case and, 
through the discovery process, share information with their adversary in the proceedings. 
This discovery process applies to both paper records and electronic records and the elec-
tronic discovery (or eDiscovery) process facilitates the processing of electronic information 
for disclosure.
The Electronic Discovery Reference Model describes a standard process for conducting 
eDiscovery with nine steps:
Information Governance
ensures that information is well organized for future 
eDiscovery efforts.
Identification
locates the information that may be responsive to a discovery request 
when the organization believes that litigation is likely.
Preservation
ensures that potentially discoverable information is protected against 
alteration or deletion.
Collection
gathers the responsive information centrally for use in the eDiscovery 
process.
Processing
screens the collected information to perform a “rough cut” of irrelevant 
information, reducing the amount of information requiring detailed screening.
Review
examines the remaining information to determine what information is 
responsive to the request and removing any information protected by attorney-client 
privilege.
Analysis
performs deeper inspection of the content and context of remaining 
information.
Production
places the information into a format that may be shared with others.
Presentation
displays the information to witnesses, the court, and other parties.

---

Investigations 
849
Conducting eDiscovery is a complex process and requires careful coordination between 
information technology professionals and legal counsel.
Evidence 
To successfully prosecute a crime, the prosecuting attorneys must provide suffi cient evi-
dence to prove an individual’s guilt beyond a reasonable doubt. In the following sections, 
we’ll explain the requirements that evidence must meet before it is allowed in court, the 
various types of evidence that may be introduced, and the requirements for handling and 
documenting evidence. 
The National Institute of Standards and Technology’s Guide to Integrat-
ing Forensic Techniques into Incident Response (SP 800-86) is a great 
reference and is available at
https://www.nist.gov/publications/
guide-integrating-forensic-techniques-incident-response
 .