Which of the following should be the PRIMARY focus of an organization with immature incident...

User awareness is essential for improving detection capabilities in an immature environment. Employees are often the first line of defense and can identify suspicious activities early.

“User awareness and training can significantly improve the detection of incidents by enabling employees to recognize and report suspicious activities.”

— CISM Review Manual 15th Edition, Chapter 4: Incident Management, Section: Detection and Analysis*

ISACA practice questions confirm that improving user awareness is the foundational step before deploying new technologies.