The Chief Risk Officer (CRO) has requested that the MTD, RTO and RPO for key business applications be identified and documented. Which of the following business documents would MOST likely contain…

A Memorandum of Understanding (MOU) is a non-binding agreement that outlines roles and responsibilities between two parties and does not contain recovery time or point objectives.

A Business Partnership Agreement (BPA) defines the commercial terms of a business relationship or partnership arrangement and does not address IT recovery metrics such as MTD, RTO, or RPO.

A Risk Assessment (RA) identifies, evaluates, and prioritizes risks to the organization but does not document specific quantitative recovery time or recovery point objectives for business applications.

A Service Level Agreement (SLA) may reference RTO and RPO as contractual performance targets with a vendor or service provider, but it does not originate or define these values - they are first identified in the BIA and then reflected downstream in SLAs.

The Business Impact Analysis (BIA) is the primary document used to identify and record Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO), and Recovery Point Objective (RPO) for key business processes and applications. The BIA assesses the operational and financial impact of disruptions, establishes recovery priorities, and produces the time-based targets that drive disaster recovery and business continuity plans. It is the foundational input from which all recovery strategies and resource requirements are derived.