What is defined by the Recovery Time Objective (RTO)?

The Recovery Time Objective (RTO) is a business-driven target that defines the maximum tolerable duration for a service outage. It specifies the timeframe within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences associated with a break in business continuity. RTOs are determined based on a Business Impact Analysis (BIA) and are used to design appropriate disaster recovery and business continuity strategies. It is a target for restoration, not the point of ultimate failure.

A. This defines the Maximum Tolerable Period of Disruption (MTPD), which is the absolute latest time recovery can occur before the business is irrevocably harmed.
B. This describes the Recovery Service Level (RSL) or Service Delivery Objective (SDO), which defines the required capacity or performance level of the restored service.
C. This is the definition of the Recovery Point Objective (RPO), which dictates the maximum acceptable amount of data loss measured in time.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. Section 3.3.2, p. 21. "The RTO is the overall length of time an information system’s components can be in the recovery phase before negatively impacting the organization’s mission or business functions."

2. ISO 22301:2019. (2019). Security and resilience — Business continuity management systems — Requirements. Clause 8.3.3. This standard requires organizations to determine RTOs for activities as part of the business impact analysis and risk assessment process.

3. Hiles, A. (Ed.). (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 11 discusses the relationship between BIA, RTO, and RPO, defining RTO as the target time for resuming a business function.