Which of the following is necessary to determine what would constitute a disaster for an organization?

A. Backup strategy analysis
B. Threat probability analysis
C. Risk analysis
D. Recovery strategy analysis