See Capability, Anomalous Event Response and Recovery Management.
Source(s):
NISTIR 8011 Vol. 1
under Anomalous Event Response and Recovery Management
An ISCM capability that ensures that both routine and unexpected events that require a response to maintain functionality and security are responded to (once identified) within a time frame that prevents or reduces the impact (i.e., consequences) of the events to the extent possible.
Source(s):
NISTIR 8011 Vol. 1