Which of the following steps of incident response is steady in nature?

Containment is a reactive phase activated only after an incident is detected - its goal is to limit the spread of damage, making it event-driven rather than steady.

Eradication is a reactive phase that occurs after containment, focused on removing the root cause of the incident - it is time-bounded and incident-specific.

Preparation is the foundational and ongoing phase of the NIST incident response lifecycle where organizations establish capabilities, tools, policies, and team readiness before incidents occur. Because threats and environments constantly evolve, preparation never truly ends - organizations continuously update playbooks, train staff, and test response capabilities. It is the only phase not triggered by an active incident.

Recovery is a reactive phase performed after eradication to restore systems to normal operation - it is directly tied to a specific incident and ends when operations normalize.