312-39V2: Certified SOC Analyst v2

A large financial services company is facing a growing number of sophisticated cyber threats aimed at its critical assets. Its Security Operations Center (SOC) primarily concentrates on log collection and basic threat monitoring. Recent security incidents, however, have exposed gaps in the SOC’s ability to proactively detect and respond to advanced threats.

Senior management has chosen to increase SOC maturity by adopting the SOC Capability Maturity Model (CMM). An initial CMM assessment found that the SOC currently aligns with Level 1, and the organization intends to reach Level 3. To accomplish this, the SOC must improve incident-response procedures, strengthen threat-intelligence integration, and define key performance metrics. The organization also plans to automate incident triage, implement behavior-based analytics, and create a continuous SOC training program.

Based on the SOC Capability Maturity Model, which of the following should be the first priority when transitioning the SOC from Level 1 to Level 3?