Explanation
The BIA is included as part of the process to determine the current state of risk and helps determine the acceptable levels of response from impacts and the current level of response, leading to a gap analysis.
Budgeting appropriately may come as a result, but is not the reason to perform the analysis. Performing an analysis may satisfy regulatory requirements, bill is not the reason to perform one. Analyzing the effect on the business is part of the process, but one must also determine the needs or acceptable effect or response.

Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
A security plan must be developed to implement the security strategy. All of the other choices should follow the development of the security plan.

Explanation/Reference:
Explanation:
The success of security programs is dependent upon alignment with organizational goals and objectives.
Communication is a secondary step. Effective communication and education of users is a critical determinant of success but alignment with organizational goals and objectives is the most important factor for success. Mere formulation of policies without effective communication to users will not ensure success.
Monitoring compliance with information security policies and procedures can be, at best, a detective mechanism that will not lead to success in the midst of uninformed users.