Which of the following has been established when a business continuity manager explains that a critical system can be unavailable up to 4 hours before operation is significantly impaired?

The Recovery Time Objective (RTO) is the target time within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences. The statement that a system can be unavailable for up to 4 hours before significant impairment directly defines this target recovery window. RTO is a key metric in business continuity planning (BCP) and disaster recovery (DR) that dictates the required speed of recovery efforts.

A. Maximum Tolerable Downtime (MTD) is the absolute longest time a system can be down before causing irreparable business harm, which is a limit, not a target.
B. A Service Level Agreement (SLA) is a contractual commitment between a service provider and a client, not an internal business continuity metric.
C. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, not the duration of a system outage.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. Appendix B: Glossary, Page B-5. "Recovery Time Objective (RTO): The maximum amount of time that a system or process can be down before the organization is significantly impacted."

2. ISACA. (2019). CRISC Review Manual, 6th Edition. Chapter 2: IT Risk Assessment. The manual discusses RTO as the determination of the acceptable downtime for a system or application.