The requirements specific to collection are set here (text not held). Read with the cross-cutting aspects of 6.1.2 and the requirement pattern of 6.2.4, an auditor would expect collection to be carried out by people informed of the purpose, scope and time frame of the matter and of the legal, matter-specific and process-specific requirements that govern it; planned before execution; using methods that keep integrity and chain of custody and that are appropriate to each source; supported by methods and metrics; adapted as new sources are found; and documented so that what was collected, from where, by whom, when and how can be shown.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.