CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
A data center experiences a complete power outage due to a regional grid failure. The incident response team successfully switches to backup power, but several non-critical systems are offline for 12 hours. The Business Continuity Plan (BCP) specifies that critical systems must be restored within 4 hours, and non-critical systems within 24 hours. Which of the following metrics was successfully met in this scenario?
- ARecovery Time Objective (RTO) for critical systems.
- BRecovery Point Objective (RPO) for critical systems.
- CRecovery Time Objective (RTO) for non-critical systems.
- DRecovery Point Objective (RPO) for non-critical systems.
Show answer & explanationAnswer & explanation
Correct answer: C. Recovery Time Objective (RTO) for non-critical systems.
The non-critical systems were offline for 12 hours, which is within the specified RTO of 24 hours for non-critical systems, meaning their recovery time objective was met.
Why the other options are wrong
- A. The RTO for critical systems (4 hours) was not met, as the scenario states 'several non-critical systems are offline for 12 hours,' and critical systems' status is not given as restored within 4 hours.
- B. RPO refers to data loss tolerance, not system restoration time, so it's irrelevant to the given scenario details.
- D. RPO refers to data loss tolerance, not system restoration time, so it's irrelevant to the given scenario details.
Recovery Time Objective (RTO)
The maximum tolerable duration of time that a computer system, application, or network can be down after a disaster or failure.
- Defines the target time for system recovery.
- Measured in time (e.g., hours, days).
- Determined during Business Impact Analysis (BIA).
Memory trick: RTO is 'Time' to 'Get Back Up', RPO is 'Data' you 'Can Lose'.