The correct answer is B. Recovery point objective (RPO).
RPO is the best answer because the question focuses on data availability. RPO defines the point in time to which data must be recoverable after a disruption. In practical terms, it determines how much data loss the organization can tolerate and therefore influences the data backup, replication, synchronization, and recovery approach.
ISACA's contingency planning guidance states that RPO represents the point in time before a disruption to which business process data can be recovered, based on the most recent backup copy. ISACA also explains that RPO is a factor of how much data loss the mission or business process can tolerate during recovery.
Option A is not the best answer because MTO addresses how long a critical function or system can be disrupted before significant harm occurs. It is more focused on outage duration than data currency. Option C is not the best answer because cost-benefit analysis helps choose among recovery options, but it does not define the data recovery requirement. Option D is not the best answer because SDO refers to the level of service required during alternate processing until normal operations are restored. ISACA's glossary distinguishes MTO and SDO from RPO.
This question maps to Information Systems Operations and Business Resilience, because ISACA's CISA Exam Content Outline includes business continuity, disaster recovery, data backup, storage, and restoration under Domain 4.
References: ISACA CISA Exam Content Outline, Domain 4; ISACA Journal, Information System Contingency Planning Guidance; ISACA Interactive Glossary, "Maximum tolerable outage" and "Service delivery objective."