According to the recommended methodology for responding to cybersecurity incidents, which of the following activities should occur during the preparation step?