Exam CISM topic 1 question 145 discussion

Recovery time objectives (RTOs) are an output of a Business Impact Analysis (BIA) process. The BIA is used to identify the criticality of business functions and systems, and the RTOs are used to determine the maximum amount of time that a specific business function or system can be down before it starts to have a significant impact on the organization. This information is then used to develop the disaster recovery plan (DRP) and service level agreements (SLAs).

B. Business impact analysis (BIA) Recovery time objectives (RTOs) are typically determined as an output of the business impact analysis (BIA) process. During the BIA, an organization assesses the potential impact of disruptions to its various business processes and systems. As part of this analysis, RTOs are established to define the maximum allowable downtime for each process or system. RTOs are a critical component of an organization's overall disaster recovery and business continuity planning efforts, as they help in prioritizing recovery efforts and ensuring that critical functions can be restored within the required timeframe.

A Business Continuity Plan is elaborated with business stakeholders also for defining the RTO, in which case A is a good response.

B. Business impact analysis (BIA)

The Recovery Time Objective (RTO) is the output of the Business impact analysis (BIA) and the input for the Business continuity plan (BCP) and disaster

A is my answer. "Recovery time objective (RTO) and recovery point objective (RPO) are two of the fundamental concepts in business continuity planning." Also, BIA is a document that takes place under business continuity planning, as well as RTO, RPO, RCO, and RCapO.