Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

The Preparation phase is responsible for all proactive activities: defining incident response rules and policies, training and organizing the human workforce, creating communication and backup plans, and conducting exercises or drills to validate those plans. It is the only phase that occurs before an incident is detected and focuses entirely on organizational readiness.

The Eradication phase focuses on removing the root cause of the incident, such as deleting malware or patching the exploited vulnerability, after containment.

The Identification phase is responsible for detecting, analyzing, and declaring that a security incident has actually occurred.

The Recovery phase restores affected systems to normal operation and monitors them to ensure the threat has been fully removed.

The Containment phase focuses on limiting the scope and spread of an active incident to prevent further damage.