After acquisition the DEFR seals what was copied using a hash-type verification function or a digital signature to show the copies match the originals, applies security controls that keep the evidence confidential, intact and available, and deals with environmental risks against spoliation. In particular the DEFR uses a suitable verification function to prove copied files match the originals, and may link the DEFR to the evidence by digital signature, biometrics or photography (a biometric feature may also be used in place of a verification function or signature, so tampering would break it). Every collected device is preserved in a way suited to its type, and evidence is preserved for its whole lifetime, which varies with jurisdiction and organizational policy.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.