How to do in place records management.

Here's how I think about it -

1. Know what you've got.

2. Know where it is.

3. Know the capabilities of the system that's storing it.

4. Risk assess those capabilities against your policies, standards and your ideal state.

5. Implement change or compensating controls for the risks that are outside your risk tolerance.

6. You're now doing manage in place.

It's harder than that - but I think those are the basics.

What did I miss?

What do you disagree with?