Of the following, who is BEST positioned to perform a business impact analysis (BIA)?

The information security team can provide security input but often lacks the deep business process knowledge required for a comprehensive BIA.

Process owners have firsthand knowledge of their specific business processes, including their dependencies, critical functions, and the financial, operational, and reputational impacts of their disruption. Their direct expertise allows for an accurate assessment of recovery time objectives (RTO) and recovery point objectives (RPO), which are fundamental outputs of a BIA.

The IT team understands the technical infrastructure but may not fully grasp the broader business implications and interdependencies of process disruptions.

Business continuity management auditors review and validate BIAs, but they are not typically the ones who initially *perform* the analysis of business impacts.