What it asks for. In CSF 1.1 this Respond category covered activities to prevent expansion of an event, mitigate its effects and resolve the incident: containment, mitigation, and RS.MI-3, which required newly identified vulnerabilities to be mitigated or documented as accepted risks. CSF 2.0 renamed the category Incident Mitigation and moved vulnerability handling to ID.RA-06.
In practice. Responders contain affected systems quickly using predefined actions such as isolating hosts, disabling accounts and blocking indicators, then eradicate the threat. Vulnerabilities found during incidents are fixed or formally accepted with an owner and review date. Evidence includes containment records, playbooks and a risk acceptance register.
Common gaps. Containment is often slowed by unclear authority to take systems offline. Risk acceptances are recorded without expiry dates and never revisited.