Which of the following techniques is MOST helpful when quantifying the potential loss impact of cyber risk?

Cost-benefit analysis is used to evaluate the economic feasibility of proposed controls but does not primarily quantify the loss impact of a risk event itself.

Penetration testing identifies vulnerabilities and potential exploit paths but does not directly quantify the business or financial loss impact if those vulnerabilities are exploited.

A Business Impact Analysis (BIA) systematically identifies and evaluates the potential effects of business disruption, including those caused by cyber incidents, on an organization's operations, finances, and reputation. By focusing on critical business processes and their dependencies, a BIA helps quantify the financial losses, operational delays, regulatory fines, and reputational damage associated with different downtime scenarios.

A security assessment evaluates the overall security posture and identifies weaknesses, but it doesn't specifically quantify the financial or operational losses resulting from a cyber incident.