ISC2 CISSP (Certified Information Systems Security Professional)Security OperationsEasy
An organization is developing a comprehensive disaster recovery plan (DRP) for its critical systems. During the planning phase, the team is determining the maximum allowable data loss that an application can sustain without causing significant business damage. Which of the following metrics are they defining?
- ARecovery Time Objective (RTO)
- BMean Time To Recover (MTTR)
- CWork Recovery Time (WRT)
- DRecovery Point Objective (RPO)
Show answer & explanationAnswer & explanation
Correct answer: D. Recovery Point Objective (RPO)
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. It determines how 'fresh' the recovered data must be, directly correlating to the data backup frequency.
Why the other options are wrong
- A. RTO defines the maximum acceptable downtime, not data loss.
- B. MTTR is an average time to repair or restore, not a maximum acceptable data loss.
- C. WRT is the time required to configure and test a recovered system, not a measure of data loss.
Recovery Point Objective (RPO)
RPO is the maximum acceptable amount of data loss, measured in time, that an organization can tolerate during a disruption. It dictates the frequency of backups or data replication.
- Measures data loss in time (e.g., 4 hours of data).
- Determines how frequently data must be backed up.
- A lower RPO means less data loss but typically higher cost.
Memory trick: RTO is for Time, RPO is for Point (data).