Which of the following BEST enables risk-based decision making in support of a business continuity plan (BCP)?

An impact analysis, specifically a Business Impact Analysis (BIA), identifies and quantifies the financial and operational consequences of disruptive events and establishes Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). This crucial information allows organizations to prioritize critical business functions and allocate resources effectively, forming the foundation for risk-based decisions within the BCP.

Control analysis evaluates the effectiveness of security controls but doesn't directly assess the business impact of an incident needed for BCP prioritization.

Root cause analysis is performed after an incident to identify underlying causes, not to proactively support BCP decision-making.

Threat analysis identifies potential threats but does not quantify the business impact or recovery objectives, which are critical for BCP decisions.