Certified Cloud Security Professional (CCSP)Cloud Security OperationsEasy
A cloud service consumer is evaluating different cloud providers for hosting a critical application. The consumer's incident response plan mandates that in the event of a major disruption, the application must be fully operational within 4 hours. This requirement directly defines which of the following Business Continuity and Disaster Recovery (BCDR) metrics?
- ARecovery Time Objective (RTO).
- BWork Recovery Time (WRT).
- CMean Time Between Failures (MTBF).
- DRecovery Point Objective (RPO).
Show answer & explanationAnswer & explanation
Correct answer: A. Recovery Time Objective (RTO).
The Recovery Time Objective (RTO) is the maximum acceptable duration of time that a system or application can be down after an incident before unacceptable consequences occur. A requirement for an application to be fully operational within 4 hours is a direct definition of the RTO.
Why the other options are wrong
- B. WRT is the time required to restore the business process to normal operations after the technology components have been recovered, which is a broader concept than just application operationalization.
- C. MTBF measures the average time between system failures, indicating reliability, not recovery time.
- D. RPO defines the maximum acceptable amount of data loss, not the time to restore operations.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that a system, application, or service can be unavailable after an incident.
- Expressed in time (e.g., hours, days).
- Dictates how quickly systems must be restored.
- A critical metric for business continuity planning.
Memory trick: RTO is about 'Time to Operate' again.