With business continuity, CISOs must navigate a complex mix of security, business priorities and operational resilience — often without clear ownership of the process.