ISC2 CISSP (Certified Information Systems Security Professional)Security and Risk ManagementMedium
An organization is conducting a Business Impact Analysis (BIA) as part of its business continuity planning. During this process, they identify that the maximum acceptable downtime for their e-commerce website is 2 hours, as every hour of outage results in significant financial losses and reputational damage. Which key metric is being defined in this scenario?
- AWork Recovery Time (WRT)
- BRecovery Time Objective (RTO)
- CRecovery Point Objective (RPO)
- DMean Time To Repair (MTTR)
Show answer & explanationAnswer & explanation
Correct answer: B. Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) is the maximum acceptable duration of time that a business process or system can be down after a disaster or disruption without causing unacceptable consequences. The scenario explicitly states 'maximum acceptable downtime... is 2 hours,' which directly defines the RTO.
Why the other options are wrong
- A. WRT is the time needed to verify and make a recovered system fully operational, which comes *after* the RTO is met.
- C. RPO is about maximum data loss, not downtime duration.
- D. MTTR is an average repair time, not a business-driven objective for acceptable downtime.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that a business process or system can be offline after an incident or disaster.
- Determines how quickly systems must be restored.
- Expressed in hours, minutes, or days.
- A lower RTO typically requires more expensive and complex recovery solutions.
Memory trick: RTO gets you back, RPO saves your data.