A newly hired CyberOps analyst is reviewing the organization's incident response program, which is modeled on NIST SP 800-61. She notices that before any incident occurs, the team has already deployed a centralized log aggregation platform, created jump bags with forensic tools, established out-of-band communication channels, and trained staff on their roles. Which phase of the NIST incident response life cycle do these activities belong to?