SSCP Systems Security Certified PractitionerIncident Response and RecoveryEasy
A healthcare organization is developing its disaster recovery plan. They have determined that their Electronic Health Record (EHR) system can tolerate a maximum data loss equivalent to 4 hours of transactions. Beyond this point, the impact on patient care and regulatory compliance becomes unacceptable. What concept does this 4-hour tolerance represent?
- AMean Time To Recover (MTTR)
- BRecovery Time Objective (RTO)
- CRecovery Point Objective (RPO)
- DMean Time Between Failures (MTBF)
Show answer & explanationAnswer & explanation
Correct answer: C. Recovery Point Objective (RPO)
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data that can be lost during a disaster. In this scenario, a 4-hour tolerance for data loss directly corresponds to the RPO.
Why the other options are wrong
- A. MTTR is an average of how long it takes to repair a failed system, not a data loss tolerance.
- B. RTO refers to the maximum acceptable downtime, not data loss.
- D. MTBF measures the expected time between system failures, not data loss tolerance.
Recovery Point Objective (RPO)
The maximum acceptable amount of data loss measured in time from the point of failure. It dictates how frequently data backups or replications must occur.
- Measured in time (e.g., 1 hour, 4 hours, 24 hours).
- Determines the frequency of data backups or synchronization.
- A lower RPO means less data loss but typically higher cost and complexity.
Memory trick: RPO is about Point (data), RTO is about Time (downtime).