See Capability, Anomalous Event Response and Recovery Management.
NISTIR 8011 Vol. 1 under Anomalous Event Response and Recovery Management
An ISCM capability that ensures that both routine and unexpected events that require a response to maintain functionality and security are responded to (once identified) within a time frame that prevents or reduces the impact (i.e., consequences) of the events to the extent possible.
NISTIR 8011 Vol. 1