Once devices are identified, DEFRs and DESs decide, on the circumstances, whether to collect them or acquire from them (factors in clause 7). Collection removes devices from where they were found to a laboratory or other controlled setting for later acquisition and analysis; powered-on and powered-off devices need different approaches and tools, and local procedures may apply. It includes documenting the whole approach and packaging devices before transport, and taking any related material (passwords written on paper, cradles, power connectors). The best method for the situation, cost and time is chosen and the choice recorded. Storage media are removed only by someone competent to do so, where appropriate and allowed; devices left behind are recorded with the justification, as the jurisdiction requires.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.