What should be the PRIMARY basis for establishing a recovery time objective (RTO) for a critical business application?

A. Business impact analysis (BIA) results
B. Related business benchmarks
C. Risk assessment results
D. Legal and regulatory requirements