During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended as the PRIMARY factor

Maximum allowable downtime (MAD) is the primary factor for determining system criticality because it directly quantifies the maximum acceptable period a business process can be interrupted without suffering unacceptable consequences. This business-driven metric dictates the urgency and priority for recovery, making it central to criticality assessment.

Mean time to restore (MTTR) is a measure of how long it takes to restore a system *after* an incident, and while important for recovery planning, it's a *technical metric* of capability, not the *business tolerance* that defines criticality.

Recovery point objective (RPO) defines the maximum tolerable data loss, which is a critical aspect of recovery, but MAD directly defines the maximum *time* the system can be down, making it a more overarching measure of criticality.

Key performance indicators (KPIs) measure the performance of a system or process; while a critical system will have important KPIs, KPIs themselves don't define the system's criticality in terms of business impact from downtime.