A recovery point objective (RPO) is required in which of the following?

A recovery point objective (RPO) specifies the maximum tolerable period in which data might be lost after a disruption and therefore drives backup-and-restore design. This metric is part of the technology-centric disaster recovery plan (DRP), which details how IT services and data will be recovered after an outage. The RPO determined during the business impact analysis is incorporated into the DRP so that backup frequency, media, and replication methods meet the business’s data-loss tolerance.

B. Information security plan – Focuses on risk controls and governance; it does not set operational recovery metrics such as RPO.

C. Incident response plan – Addresses detection, containment, and eradication of security incidents, not data-restoration time or loss limits.

D. Business continuity plan (BCP) – Provides overarching process-continuity strategies; specific data-restoration parameters (RPO) are implemented in the subordinate DRP.

1. ISACA

CISM Review Manual

15th ed.

“Disaster Recovery Planning

” pp. 264-265: defines RPO as a required element of the DRP.

2. NIST Special Publication 800-34 Rev.1

“Contingency Planning Guide for Federal Information Systems

” §3.4.3 & Table 3-2: lists RPO as a key input to the information-system (DR) contingency plan.

3. University of Washington

INFO 498 “Business Continuity & Disaster Recovery” course slides

Week 4

slide 18: identifies RPO/RTO metrics as DRP components.

4. IEEE Communications Magazine

Vol. 52

No. 3 (2014)

“Designing Disaster Recovery Strategies

” p. 42: states RPO is used to formulate backup schedules within DR plans.