Before collecting or acquiring anything, the DEFR records the scene as found visually (photograph, video or sketch, chosen on circumstances, cost, time, resources and priorities) and records other items that may hold relevant material (notes, sticky notes, diaries). The DEFR: records type, brand, model and serial numbers and identifies all devices that may need taking, documenting and where needed collecting every mobile device together with its SIM and memory cards and its charging accessories, and looking for original phone packaging that may carry PIN and PUK codes; for a networked device, identifies the services it provides to understand dependencies and criticality before deciding to disconnect it, but may disconnect to protect evidence if network-based threats appear ongoing; for CCTV, records the number of cameras, which are recording, and the make, model and key settings (display, recording, storage location) so the system can be put back as it was; keeps power states as found where possible, keeping battery devices charged and gathering chargers and cables, though switching a device off may be sensible if it will be examined at some unknown later date; and considers a wireless signal detector for hidden devices, recording when one is not used for cost or time reasons.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.