SSCP Systems Security Certified PractitionerIncident Response and RecoveryMedium
A financial institution is updating its Business Continuity Plan (BCP). The BCP team has identified several critical business functions, including trading operations and customer account access. For these functions, they need to ensure that the maximum amount of data loss that can be tolerated is less than 15 minutes. What element of the BCP is being defined here?
- AMaximum Tolerable Downtime (MTD)
- BRecovery Point Objective (RPO)
- CRecovery Time Objective (RTO)
- DMean Time To Repair (MTTR)
Show answer & explanationAnswer & explanation
Correct answer: B. Recovery Point Objective (RPO)
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, in this case, less than 15 minutes, which directly addresses the requirement for critical business functions.
Why the other options are wrong
- A. MTD is the total time a system can be down before unacceptable consequences, encompassing RTO and WRT.
- C. RTO defines maximum acceptable downtime, not data loss.
- D. MTTR is an average repair time, not an objective for data loss.
Recovery Point Objective (RPO)
The maximum acceptable amount of data loss that an organization can tolerate, measured in time (e.g., 1 hour, 1 day) from the point of failure.
- Determines backup frequency.
- Dictates how much data can be lost.
- Lower RPO means more frequent backups and higher cost.
Memory trick: RPO is 'Point' of 'Data' return.