What it asks for. In CSF 1.1 this Respond category required response processes and procedures to be executed and maintained so that detected incidents receive a timely response. RS.RP-1 asked that the response plan is executed during or after an incident. CSF 2.0 folded this into RS.MA, Incident Management.
In practice. An incident response plan with playbooks for common scenarios is triggered by defined criteria, and roles, escalation paths and decision rights are clear. The plan is exercised regularly and updated after incidents and tests. Evidence includes the plan, playbooks, incident tickets showing the plan in use and exercise reports.
Common gaps. Plans are frequently not consulted during real incidents because they are too long or out of date. Playbooks may not cover cloud, identity or supplier compromise.