Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

The Recovery phase focuses on restoring affected systems and services to normal operation after threats have been removed, not on defining rules or creating plans.

The Eradication phase is concerned with removing the root cause of the incident such as deleting malware or patching vulnerabilities, not on pre-incident planning or workforce organization.

The Identification phase involves detecting, logging, and confirming that a security incident has occurred, not on defining rules or building response infrastructure.

The Containment phase focuses on limiting the spread and damage of an active incident, not on workforce collaboration or plan development.

The Preparation phase establishes the entire incident response foundation - it involves defining rules and policies, assembling and training the incident response workforce, building communication plans, creating backup and continuity plans, and running drills or tabletop exercises to validate those plans, all before any incident takes place.