SSCP Systems Security Certified PractitionerIncident Response and RecoveryMedium
A company's Business Impact Analysis (BIA) determines that its e-commerce website has a Maximum Tolerable Downtime (MTD) of 4 hours and a Recovery Time Objective (RTO) of 2 hours. What is the MOST critical implication of these metrics for the disaster recovery plan?
- AThe disaster recovery plan must ensure the website is fully operational within 2 hours of an incident.
- BThe business can tolerate a maximum data loss of 2 hours.
- CThe recovery point objective (RPO) must be less than 2 hours.
- DThe incident response team must be able to detect and contain an incident within 2 hours.
Show answer & explanationAnswer & explanation
Correct answer: A. The disaster recovery plan must ensure the website is fully operational within 2 hours of an incident.
The RTO (Recovery Time Objective) defines the maximum acceptable length of time that an application can be down after a disaster. An RTO of 2 hours means the system must be fully restored and operational within that timeframe.
Why the other options are wrong
- B. The RPO, not the RTO or MTD, defines the maximum acceptable data loss. The RTO of 2 hours limits downtime, not data loss.
- C. RPO (Recovery Point Objective) is related to data loss, not directly defined by RTO and MTD values alone. While a low RPO is desirable, it's not the 'most critical implication' of the given RTO.
- D. While detection and containment are important, the RTO specifically refers to the time it takes to recover, not the time to respond initially.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that an application or service can be unavailable after a disruption before unacceptable consequences occur.
- Defines the target downtime.
- Determined by the business impact analysis (BIA).
- A key metric for disaster recovery planning.
Memory trick: RTO is 'Time' to get back, RPO is 'Point' of data loss.