In business continuity planning, which analysis identifies critical functions and recovery objectives?

• A. Business impact analysis.
• B. Threat modeling.
• C. Asset inventory.
• D. Security policy review.

Answer: (A)

A Business Impact Analysis identifies which functions are essential to keep the business running and what recovery objectives are required. It analyzes how interruptions affect operations, revenue, regulatory compliance, and customer trust, then determines how quickly each function must be restored and what resources are needed. This process defines priorities and sets recovery timelines (like RTOs and RPOs), guiding the development of effective continuity strategies. Threat modeling focuses on potential threats and vulnerabilities, asset inventory lists assets, and security policy review examines governance and controls—none of these by themselves pinpoint essential functions or establish recovery objectives.