A company is facing penalties for failing to effectively comply with e-discovery requests. Which of the following could reduce the overall risk to the company from this issue?

File system encryption without key escrow still leaves the organization unable to recover data if the encrypting user's credentials are unavailable, which does not mitigate e-discovery failure.

A decentralized password repository introduces additional security vulnerabilities and does not provide the reliable, auditable key recovery that e-discovery compliance demands.

Archiving old domain passwords is an ad-hoc approach that lacks formal escrow governance and cannot guarantee that all encrypted files remain recoverable for legal proceedings.

When encryption tools rely on public keys from a corporate PKI with escrowed private keys, the organization retains the ability to decrypt any protected file at any time through the key escrow mechanism. This directly addresses e-discovery risk because legal holds can always be fulfilled without depending on individual users, and the process is auditable and centrally governed.