On arrival, and subject to local law, the DEFR secures and protects the place where the evidence is: takes control of the area holding the devices; establishes who is in charge of the location; moves people away from devices and power supplies; records everyone with access to the location or a possible part in the incident; leaves devices in their power state (on stays on, off stays off); where possible records the scene, components and cabling as found by sketch, photograph or video, or failing a camera draws and labels a sketch so the system can be rebuilt and checked later; and, if allowed, searches for notes, diaries, papers, laptops and manuals that may reveal passwords or PINs. Local rules on admitting photographs and video are followed, and evidence may sit in less obvious places such as distributed or virtual storage. The DEFR understands every risk in the work ahead and plans to protect both people and evidence.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.