A Chief Information Security Officer (CISO) is developing a new BIA for the organization. The CISO wants to gather requirements to determine the appropriate RTO and RPO for the organization's ERP…

A data custodian is a technical role responsible for implementing data controls, not defining business recovery requirements.

A data owner focuses on data classification and access policy, not on quantifying the operational impact of system unavailability.

A security analyst assesses threats and vulnerabilities but lacks the business context to define acceptable downtime or data loss thresholds.

The business unit director is the most qualified because they understand operational workflows, revenue impact, and tolerance for downtime and data loss. RTO and RPO are business-driven metrics that reflect how quickly operations must be restored and how much data loss is acceptable - decisions that belong to the business, not IT. Technical staff can implement what the business requires, but cannot define what the business needs.

The CEO operates at a strategic level and delegates operational recovery requirements to the business unit leaders who manage day-to-day processes.