An analyst confirms that several workstations are infected with a worm that is actively spreading across the internal network. Following NIST SP 800-61, the incident response team first disconnects the affected VLAN to stop the spread, then removes the malware and patches the exploited vulnerability, and finally restores the systems from clean backups and monitors them before returning them to production. Which NIST incident handling phase encompasses ALL of the actions the team performed in this sequence?