ISC2 CISSP (Certified Information Systems Security Professional)Security OperationsMedium
A global manufacturing company is developing a comprehensive disaster recovery plan (DRP). The leadership team has identified that the critical enterprise resource planning (ERP) system must be restored and fully operational within 24 hours of a disaster. Which metric does this 24-hour timeframe represent?
- AMaximum Tolerable Downtime (MTD)
- BRecovery Point Objective (RPO)
- CRecovery Time Objective (RTO)
- DWork Recovery Time (WRT)
Show answer & explanationAnswer & explanation
Correct answer: C. Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) defines the maximum acceptable length of time that a system can be down after an incident before unacceptable consequences occur. In this case, the 24-hour timeframe for the ERP system to be fully operational directly corresponds to its RTO.
Why the other options are wrong
- A. MTD is the absolute maximum time a system can be unavailable, typically longer than RTO, representing the point of unacceptable impact.
- B. RPO defines the maximum acceptable amount of data loss, not the time for recovery.
- D. WRT is the time required to configure a recovered system, test it, and make it available for regular business operations after the RTO has been met.
Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) is the maximum acceptable duration of time that a system, application, or service can be unavailable after a disaster or disruption.
- Measures downtime duration.
- Determined by business impact analysis.
- Target for recovery efforts.
Memory trick: RTO is 'Time' to get back up; RPO is 'Point' of data loss.