The Preparation phase of the NIST Incident Response Lifecycle focuses on establishing the necessary tools, processes, and skills to handle incidents effectively before they occur. A key activity within this phase is to test the incident response plan and team readiness through exercises and drills. Conducting response drill scenarios validates procedures, roles, and communication channels, ensuring the organization is prepared to act efficiently during a real security incident.

A. Restoring systems from backups is a core activity of the Recovery phase, which aims to return affected systems to normal operation.

B. Documenting postmortem reports is part of the Post-Incident Activity phase, which focuses on learning from the incident to improve future responses.

C. Identifying compromised accounts occurs during the Detection & Analysis phase, after a potential incident has been detected and is being investigated.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide. Section 2.3.1, "Preparation," states that this phase includes "training, testing, and evaluating" incident response plans, which encompasses drills.