Storage media at a scene are usually the least volatile and may come last, but often hold what analysts seek. The DEFR: records where each medium was found (bay, cable and connector, USB port), its make, model and any serial number; decides on the incident and resources whether to collect it or acquire on site (on-site acquisition of a hard disk follows Figure 4); packages collected media suitably; labels all media and associated parts without placing labels on mechanical parts or over serial, model or part numbers, handles and stores collected media to keep integrity, and where possible seals them with tamper-evident seals signed by the DEFR or person in charge; stores them in conditions suited to data preservation; and knows the maximum period the jurisdiction accepts given each medium's data retention capability.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.