A cloud outage cost a retailer a day of online sales. The CFO has funded a second region and wants migration started this quarter. No business impact analysis exists. What should the security manager do FIRST?
A. Design the second region with the cloud team
B. Conduct a business impact analysis to set recovery targets
C. Negotiate a stronger uptime commitment with the provider
D. Buy business interruption insurance for cloud outages
(Explain your answer for more points in the comments!)