Which of the following is the PRIMARY objective of a business impact analysis (BIA)?

The primary objective of a Business Impact Analysis (BIA) is to identify critical business processes and determine the operational and financial impacts of their disruption. By quantifying these impacts over time, the BIA allows an organization to establish clear recovery priorities. This ensures that limited resources are directed toward restoring the most critical functions first during a disaster. While defining the Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are key outcomes of the BIA, they are subsets of the overarching goal of prioritizing recovery efforts. The BIA aligns IT disaster recovery strategies directly with business criticality and continuity requirements.

B. Defining the RPO is a specific metric outcome of a BIA, but it is a subset of the broader primary objective of determining overall recovery priorities.
C. Confirming control effectiveness is the objective of security audits, penetration testing, and control assessments, not the BIA.
D. Analyzing vulnerabilities is part of a risk assessment or vulnerability management program, whereas the BIA focuses strictly on business impact and continuity.

1. ISACA CISM Review Manual, 15th Edition. Chapter 4: Information Security Incident Management, Section 4.10 (Business Impact Analysis).

2. NIST Special Publication 800-34 Rev. 1, "Contingency Planning Guide for Federal Information Systems," Section 3.2 (Conducting the BIA).

3. ISO 22301:2019, "Security and resilience — Business continuity management systems," Section 8.2.2 (Business impact analysis).