CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
A company is conducting a business impact analysis (BIA) to prioritize its critical business functions and supporting IT systems. The BIA team has identified that the maximum tolerable period for an outage of its online sales platform is 4 hours. What does this 4-hour period represent?
- ARecovery Time Objective (RTO)
- BRecovery Point Objective (RPO)
- CMaximum Tolerable Downtime (MTD)
- DWork Recovery Time (WRT)
Show answer & explanationAnswer & explanation
Correct answer: C. Maximum Tolerable Downtime (MTD)
The Maximum Tolerable Downtime (MTD), also known as Maximum Tolerable Period of Disruption (MTPD), is the maximum time a business process can be inoperative before the organization suffers unacceptable consequences.
Why the other options are wrong
- A. RTO is the target time for recovery of an IT system, not the business's maximum tolerance.
- B. RPO is the maximum acceptable amount of data loss, not outage duration.
- D. WRT is the time required to configure a recovered system and test its functionality.
Maximum Tolerable Downtime (MTD)
The maximum period of time that a business process or function can be unavailable before the organization experiences unacceptable consequences.
- Determined during Business Impact Analysis (BIA).
- A business-driven metric.
- Higher than RTO, as RTO is a target for IT recovery, MTD is the business's absolute limit.
Memory trick: RPO, RTO, MTD: Time and data limits.