Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

The preparation phase is the initial stage of incident handling where an organization develops policies, defines roles, establishes communication plans, creates backup and recovery strategies, and conducts training and testing to ensure readiness before an incident occurs. This proactive approach lays the groundwork for effective incident response.

The containment phase focuses on limiting the scope and impact of an active incident.

The identification phase involves detecting and confirming a security incident.

The recovery phase focuses on restoring systems and services to normal operation after an incident has been contained and eradicated.