Home/BoK/Templates/Legal Hold Checklist
Back to Hub
Last Reviewed: 2026-06-25
Reviewer Role: Insider Risk / Legal / Privacy review
Advanced Asset
Investigation ModuleInteractive Sheet

Legal Hold Checklist

A legal hold checklist helps organizations coordinate preservation obligations when insider risk matters may involve litigation, regulatory inquiry, employment dispute, law enforcement, or contractual claims.

Primary Audience & Scope

Legal, eDiscovery, investigations, IT, HR

When to Use

  • •Triage, investigation, preservation, containment, or legal review is required.
  • •A consistent record is needed across teams.
  • •A matter may require later review, audit, or legal defensibility.

Interactive Work Area

Fill or track items interactively and copy out to your Clipboard

Template Table Structure

FieldWorking prompt
Case/resource field 1Use this field to document: Identify hold trigger.
Case/resource field 2Use this field to document: Name matter owner.
Case/resource field 3Use this field to document: Identify custodians.
Case/resource field 4Use this field to document: Map data sources.
Case/resource field 5Use this field to document: Define preservation scope and time period.
Case/resource field 6Use this field to document: Issue hold notice through approved process.
Case/resource field 7Use this field to document: Track custodian acknowledgments.
Case/resource field 8Use this field to document: Suspend auto-deletion where appropriate.

Checklist Audit List

0% Done(0/10)
Check
Checklist item

Identify hold trigger.

Evidence: Owner / date / evidence

Name matter owner.

Evidence: Owner / date / evidence

Identify custodians.

Evidence: Owner / date / evidence

Map data sources.

Evidence: Owner / date / evidence

Define preservation scope and time period.

Evidence: Owner / date / evidence

Issue hold notice through approved process.

Evidence: Owner / date / evidence

Track custodian acknowledgments.

Evidence: Owner / date / evidence

Suspend auto-deletion where appropriate.

Evidence: Owner / date / evidence

Monitor compliance.

Evidence: Owner / date / evidence

Modify or release hold when authorized by Legal.

Evidence: Owner / date / evidence

What Completion Looks Like

  • 1Decision documented.
  • 2Owner assigned.
  • 3Evidence and actions recorded.
  • 4Scope and authority preserved.
  • 5Follow-up action created where needed.

Insider Risk Capability Framework™ (IRCF™) Alignment

Primary IRCF™ Component
Oversight and Compliance
Programmatic RelevanceSupports consistent, defensible handling of insider risk matters.
Non-legal-advice Compliance NoteThis resource is a planning aid and does not provide legal advice. Organizations should adapt it to their policies, jurisdictions, labor obligations, privacy requirements, contracts, and risk appetite. Sensitive monitoring, investigation, employment, evidence, legal hold, and employee-data activities should be reviewed by appropriate Legal, Privacy, HR, Compliance, and labor stakeholders before use.

Operationalize This Template in RiskTKO®

Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. Access Lockdown Checklist

Request an Insider Risk AssessmentSee RiskTKO® in Action