A business impact analysis finds that payroll must resume within eight hours. How should this inform security risk treatment?

1. Use the recovery requirement to evaluate continuity controls and residual outage risk
2. Treat the eight hours as the maximum permitted data loss
3. Ignore it because BIA is unrelated to security
4. Assume every system has the same eight-hour requirement