A newly hired SOC manager reviews the organization's incident response program and discovers that analysts frequently waste time during active incidents locating contact information for legal counsel, deciding which forensic tools to use, and clarifying who has authority to disconnect production systems. The manager wants to address the root cause by strengthening a specific phase of the incident response workflow. Which phase should the manager focus on to resolve these recurring issues?