Defining rules, collaborating human workforce, creating a backup plan, and testing the plans are within what phase of the Incident Handling Process?

The Preparation phase, as defined in NIST SP 800-61, encompasses establishing incident response policies, assembling and training the response team, creating communication plans, and validating those plans through exercises or tests. Defining rules and collaborating with staff are policy and team-readiness tasks, while creating and testing backup plans ensures continuity - all hallmarks of pre-incident preparation. No active incident is required for this phase; it is entirely proactive.

The Containment phase focuses on limiting the scope and spread of an incident that is already occurring, not on building policies or testing plans.

The Recovery phase involves restoring affected systems and services to normal operation after an incident has been contained and eradicated.

The Identification phase focuses on detecting, analyzing, and confirming that a security incident has actually occurred.