ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
A company is reviewing its disaster recovery plan. They realize that while they have backups, the time it would take to restore all critical systems and data from those backups is too long to meet their business's needs. Which metric is primarily being violated in this scenario?
- AMaximum Tolerable Downtime (MTD)
- BMean Time To Failure (MTTF)
- CRecovery Point Objective (RPO)
- DRecovery Time Objective (RTO)
Show answer & explanationAnswer & explanation
Correct answer: D. Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) defines the maximum acceptable length of time that a computer system, application, or network can be down after a disaster. If the restoration time is too long, the RTO is being violated.
Why the other options are wrong
- A. MTD is the absolute maximum downtime the business can tolerate, RTO is the *target* for recovery.
- B. MTTF measures the expected lifespan of a system, not recovery time.
- C. RPO relates to data loss, not the time taken for system restoration.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that a business process or system can be unavailable after an incident or disaster before unacceptable consequences occur.
- Determines the speed at which recovery must happen.
- Expressed in time (e.g., 4 hours, 24 hours).
- Should always be less than or equal to the MTD.
Memory trick: RTO: Recovery Time's Target Objective.