According to the CHFI v11 objectives and the Electronic Discovery Reference Model (EDRM) framework, the activity described in this scenario corresponds to the Information Governance stage. Information governance is the foundational phase of the EDRM cycle and focuses on establishing policies, procedures, controls, and standards to manage electronic information throughout its lifecycle. This includes defining data retention schedules, access control policies, compliance requirements, preservation rules, and audit readiness.
In CHFI v11, information governance is emphasized as a proactive and strategic function that ensures an organization is prepared for future investigations, audits, litigation, or regulatory inquiries. By implementing governance controls after an investigation, organizations strengthen forensic readiness, reduce legal risk, and ensure that electronic data remains reliable, authentic, and admissible as evidence.
The other options do not accurately match the described activity. Disposal (Option A) refers to defensible deletion after legal hold requirements expire. Collection (Option C) involves acquiring data for analysis, while Identification (Option D) focuses on locating potentially relevant data sources. None of these address long- term policy creation or enterprise-wide data control.
The CHFI v11 Exam Blueprint explicitly includes Information Governance within the eDiscovery process, highlighting its role in compliance, risk mitigation, and evidence integrity management, making Option B the correct and exam-aligned answer