ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
A financial institution is implementing a new business continuity plan. As part of this, they are defining the maximum acceptable period of time that a business process can be unavailable before the continuity of the business is severely impacted. What critical metric are they defining?
- AWork Recovery Time (WRT)
- BRecovery Time Objective (RTO)
- CMaximum Tolerable Downtime (MTD)
- DRecovery Point Objective (RPO)
Show answer & explanationAnswer & explanation
Correct answer: C. Maximum Tolerable Downtime (MTD)
Maximum Tolerable Downtime (MTD) defines the total amount of time a system or business process can be inoperative before the organization experiences unacceptable consequences. It sets the absolute upper limit for outage duration.
Why the other options are wrong
- A. WRT is the time needed to verify system integrity and functionality after recovery, before normal operations resume.
- B. RTO is the target time for system restoration, which must be less than or equal to MTD.
- D. RPO is the maximum acceptable data loss, not the duration of unavailability.
Maximum Tolerable Downtime (MTD)
The total amount of time a business process or system can be inoperative before the organization experiences unacceptable consequences or significant damage.
- Absolute upper limit for outage duration
- Determined by Business Impact Analysis (BIA)
- RTO must be less than or equal to MTD
Memory trick: MTD: Max Tolerable Downtime; RTO: Recovery Time Objective.