ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
An organization is conducting a Business Impact Analysis (BIA). They have identified that the maximum acceptable data loss for their customer relationship management (CRM) system is 2 hours. What critical metric does this 2-hour window represent?
- AWork Recovery Time (WRT)
- BRecovery Point Objective (RPO)
- CMaximum Tolerable Downtime (MTD)
- DRecovery Time Objective (RTO)
Show answer & explanationAnswer & explanation
Correct answer: B. Recovery Point Objective (RPO)
The Recovery Point Objective (RPO) defines the maximum amount of data (measured in time) that an organization can afford to lose following an incident. A 2-hour window means data must be recoverable to a point no older than 2 hours before the incident.
Why the other options are wrong
- A. WRT is the time required to configure and test systems after restoration to ensure full functionality, not data loss.
- C. MTD is the total time a system can be down before unacceptable consequences, encompassing RTO and WRT.
- D. RTO is the maximum acceptable time to restore operations after a disaster, not data loss.
Recovery Point Objective (RPO)
The maximum acceptable amount of data loss measured in time. It defines the point in time to which data must be recovered after a disaster.
- Measured in time (e.g., seconds, minutes, hours).
- Determined by the business impact of data loss.
- A lower RPO typically requires more frequent backups or replication.
Memory trick: RPO: 'P' for Point in time, like a data snapshot.