After a malware attack was contained and remediated, a note to employees was sent by the hospital CIO. The note had instructions about what to do if the employee received a suspicious e-mail that could be a phishing attack. This activity best describes containing an incident preparation phase containment phase , post-incident phase minimizing litigation