Find out what you have and where. How much data do you have and what are the sources? Assess, index, and inventory.
Determine what content you have that is related to risk. Are there social security numbers in email boxes? Is there PII on your fileshares?
Create a policy that fits your company’s specific needs and environment, train people on that policy, and use it to guide the cleanup and remediation process.
Finally, remediate existing legacy content by: