Defining rules, collaborating human workforce, creating a backup plan, and testing the plans are within what phase of the Incident Handling Process?

The Preparation phase is the foundational pre-incident stage defined in NIST SP 800-61 where organizations establish security policies and rules, assign and train their human workforce, create backup and contingency plans, and test those plans through exercises or drills. Every activity listed in the question - defining rules, collaborating workforce, creating backup plans, and testing plans - is a preparation activity performed before an incident is detected.

The Containment phase focuses on limiting the spread and damage of an incident that is already in progress.

The Recovery phase involves restoring affected systems, services, and data to normal operation after an incident has been eradicated.

The Identification phase involves detecting events, analyzing indicators, and determining whether a security incident has actually occurred.