ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
A multinational corporation operates a crucial database that processes real-time financial transactions globally. Due to regulatory compliance and business demands, they must ensure that in the event of a primary data center failure, no more than 15 minutes of data can be lost. Which recovery metric does this requirement directly address?
- ARecovery Point Objective (RPO)
- BWork Recovery Time (WRT)
- CRecovery Time Objective (RTO)
- DMaximum Tolerable Downtime (MTD)
Show answer & explanationAnswer & explanation
Correct answer: A. Recovery Point Objective (RPO)
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data that can be lost from a system due to an incident. A requirement for 'no more than 15 minutes of data' directly specifies the RPO.
Why the other options are wrong
- B. WRT is the time needed to verify and make systems fully operational after recovery.
- C. RTO defines the maximum acceptable downtime, not data loss.
- D. MTD is the total maximum acceptable outage for a business function.
Recovery Point Objective (RPO)
The maximum acceptable amount of data that can be lost from a system or application due to an incident or disaster, typically measured in units of time.
- Determines the frequency of data backups or replication.
- Expressed in time (e.g., 1 hour, 1 day, near-zero).
- A lower RPO requires more frequent synchronization or backups.
Memory trick: RPO: Recovery Point is about the data's Past Objective.