Build Custodian ESI Source Map
Skill: Convert custodian interviews into a structured ESI source inventory
Region: United States Category: Legal / eDiscovery Does: Takes custodian-interview responses and IT input and assembles a structured ESI source map — a custodian × data-source × data-type inventory with volumes, locations, retention policies, and collection priority — used to scope preservation and collection and to drive the FRCP 26(f) meet-and-confer. Authority: EDRM Information Governance Reference Model (IGRM) · The Sedona Principles, Principle 3 · FRCP 26(f) / 26(b)(2)(B)
The ESI source map is the factual backbone of a defensible discovery plan: it turns "where could relevant data live?" into a tracked inventory. It feeds the 26(f) conference (scope, accessibility, cost), the preservation certification, and the collection work plan. Sources flagged not reasonably accessible (FRCP 26(b)(2)(B)) are identified here for cost-shifting arguments.
When this applies
- After a legal hold issues and before collection — to map every place in-scope ESI may reside per custodian.
- To prepare the 26(f) meet-and-confer: what will be collected, from where, in what format, and at what cost; which sources are accessible vs not.
Input data required
| Group | Fields |
|---|---|
| Custodian | name, role/title, department, employment status, hold status |
| Data source | system/app (mailbox, OneDrive, SharePoint, Teams/Slack, file share, laptop, mobile, cloud SaaS, legacy archive, paper) |
| Data type | email, documents, chat/IM, text/SMS, voicemail, structured DB records, images |
| Location | on-prem / M365 / Google / third-party SaaS / personal device (BYOD) / offsite |
| Volume | estimated size or item count (GB / # items) |
| Retention | governing retention policy + auto-deletion window |
| Accessibility | reasonably accessible vs not reasonably accessible (legacy/backup/proprietary) |
| Priority | collection priority (key custodian, peripheral, on-hold-only) |
Output structure (CSV/JSON columns)
custodian_name, role, department, hold_status,
data_source, data_type, location, custody_owner,
estimated_volume, volume_unit, item_count,
retention_policy, auto_delete_window, accessibility,
collection_method, collection_priority, notes
One row per custodian × data-source combination. A single custodian typically spans many rows (mailbox, OneDrive, Teams, laptop, phone…).
Build rules
- Granularity = custodian × source. Each distinct repository for each custodian is its own row so volume, retention, and priority can differ.
- Capture retention + auto-deletion per source — this is what justifies the urgency and scope of the hold and identifies spoliation risk windows.
- Flag accessibility explicitly. Mark backup tapes, decommissioned systems, and proprietary/legacy formats as not reasonably accessible to support FRCP 26(b)(2)(B) cost/burden positions at the 26(f) conference.
- Record collection method (in-place/Purview export, forensic image, targeted collection, API pull) — drives cost and defensibility.
- Don't forget modern + personal sources: Teams/Slack chat, mobile texts (incl. BYOD), ephemeral messaging, and SaaS apps are routinely overlooked and routinely sanctioned.
- Keep it living — update as custodians are added/removed and as IT refines volumes.
Worked example (CSV — one custodian, several sources)
custodian_name,role,department,hold_status,data_source,data_type,location,estimated_volume,volume_unit,retention_policy,auto_delete_window,accessibility,collection_method,collection_priority
"Doe, Jane",VP Procurement,Procurement,Acknowledged,Exchange Online mailbox,Email,M365,8.5,GB,Default MRM,24 months,Accessible,Purview eDiscovery export,High
"Doe, Jane",VP Procurement,Procurement,Acknowledged,OneDrive,Documents,M365,42,GB,Default,None,Accessible,Purview export,High
"Doe, Jane",VP Procurement,Procurement,Acknowledged,Teams chat,Chat/IM,M365,1.2,GB,Teams retention,90 days,Accessible,Purview export,High
"Doe, Jane",VP Procurement,Procurement,Acknowledged,iPhone (BYOD),Text/SMS,Personal device,,items,N/A,N/A,Limited,Targeted mobile collection,Medium
"Doe, Jane",VP Procurement,Procurement,Acknowledged,Legacy SAP archive,DB records,On-prem legacy,,GB,7-year,N/A,Not reasonably accessible,Vendor extract (cost-shift),Low
The map shows the high-priority M365 sources for immediate collection, the BYOD texts needing a targeted method, and the legacy SAP archive flagged for a cost-shifting discussion.
Validation checklist
- One row per custodian × data-source; key custodians fully decomposed across all their repositories
- Retention policy + auto-deletion window captured per source (spoliation-risk windows visible)
- Accessibility flagged; not-reasonably-accessible sources identified for FRCP 26(b)(2)(B)
- Modern and personal/BYOD sources included (Teams/Slack, mobile texts, SaaS, ephemeral apps)
- Estimated volumes/item counts present to support cost and proportionality at 26(f)
- Collection method and priority assigned per source
- Map cross-checked against the legal-hold custodian roster; kept updated as scope changes
- Ready to drive the 26(f) conference and the collection work plan
Last updated: 2026-05-31 — confirm source categories, accessibility determinations, and proportionality positions against the current FRCP 26(f)/26(b)(2)(B), the EDRM IGRM, and the Sedona Principles before relying on the map for the meet-and-confer.