CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityEasy
An organization is conducting a business impact analysis (BIA) for its critical applications. One application, a customer relationship management (CRM) system, is identified as having a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. What does the RPO of 1 hour specifically indicate for this CRM system?
- AThe maximum amount of data loss that is tolerable.
- BThe frequency at which data backups are performed.
- CThe maximum acceptable downtime for the system.
- DThe time required to restore the system to operational status.
Show answer & explanationAnswer & explanation
Correct answer: A. The maximum amount of data loss that is tolerable.
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 1 hour means the organization can tolerate losing up to one hour's worth of data.
Why the other options are wrong
- B. While related, RPO defines the *maximum tolerable loss*, not necessarily the backup frequency, which could be more frequent than the RPO.
- C. This describes the Recovery Time Objective (RTO).
- D. This describes the Recovery Time Objective (RTO).
Recovery Point Objective (RPO)
The maximum acceptable amount of data (measured in time) that an organization can afford to lose during a disaster or outage.
- Measures data loss in units of time (e.g., 1 hour, 24 hours).
- Determined by the business impact analysis (BIA).
- Influences backup and replication strategies.
Memory trick: RTO is about Time, RPO is about data Points.