The DEFR identifies, collects, acquires and preserves evidence at the scene, writes the collection and acquisition report (not necessarily the analysis report), and is responsible for keeping evidence intact and authentic, so needs sufficient experience, skill and knowledge. The DES gives the DEFR specialist technical support in the same four activities at the scene, and the DEFR may also draw on other technical support staff. The Annex A competency matrix helps place each at the right level; where an incident response team exists, ISO/IEC 27035 covers the DEFR and DES as its members.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.