A security practitioner has been asked to model best practices for disaster recovery (DR) and business continuity. The practitioner has decided that a formal committee is needed to establish a business continuity policy. Which of the following BEST describes this stage of business continuity development? A. Developing and Implementing business continuity plans (BCP) B. Project Initiation and Management C. Risk Evaluation and Control D. Business impact analysis (BIA)