What is the second step that is missing in the following graphic?

What is the second step that is missing in the following graphic?

A.
Business impact analysis

B.
NIST standard

C.
Management approval and resource allocation

D.
Change control

Explanation:
A: The missing step is the business impact analysis (BIA). The steps of the BIA are listed next:

Identify companys critical business functions.
Decide on information-gathering techniques: interviews, surveys, qualitative or quantitative questionnaires.
Identify resources these functions depend upon.
Calculate how long these functions can be without these resources.
Identify vulnerabilities and threats to these functions.
Calculate risk for each different business function.
Develop backup solutions for resources based on tolerable outage times.
Develop recovery solutions for the companys individual departments and for the company as a whole.