What does Recovery Time Objective (RTO) define in disaster recovery planning?

• A. The maximum acceptable downtime for a process.
• B. The minimum data retention period.
• C. The time to train staff after an incident.
• D. The threshold for supplier performance.

Answer: (B)

RTO is the maximum acceptable downtime for a process or service after a disruption. This target tells you how quickly you must restore operations to avoid unacceptable impacts on the business, guiding decisions about recovery strategies, such as whether you need a hot or warm backup site, automated failover, or rapid data restoration processes. It’s all about how long you can tolerate the service being unavailable, not about how much data you can lose.

This is different from data-related objectives. The data-focused objective—how recent the recovered data must be—is the Recovery Point Objective, which sets the acceptable data loss window. Also not part of RTO are policies like how long to keep data in storage, which is a data retention requirement, or how long it takes to train staff after an incident, or thresholds for supplier performance. Those concerns influence readiness and SLAs, but they don’t define how quickly you must bring a service back online.