A critical process's recovery target is defined by IT without consulting business owners. What should happen?

1. Validate the target against business impact and tolerable disruption
2. Remove recovery planning because ownership is disputed
3. Accept IT's convenient target as the business requirement
4. Choose the shortest target offered by any vendor regardless of cost