Evidence exists in physical form (the data within a tangible device) and logical form (its virtual representation). Identification means searching for, recognising and documenting potential digital evidence: it locates the media and devices that store or process data which could bear on the incident, ranks collection by volatility so that collection and acquisition happen in the order that does least damage and yields the best evidence, and considers that evidence may be hidden. Cloud services, NAS and SAN add a virtual element, so not every medium is easy to locate. The DEFR searches systematically and thoroughly, since small, disguised or mixed-in devices are easily missed.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.