Do you know the differences between RTO and RPO? Even if you know what the acronyms mean, (recovery time objective for RTO and recovery point objective for RPO), they can still be a little confusing.
As an example, can you answer this sample Security+ question?
Q. You are helping implement your company’s business continuity plan. For one system, the plan requires an RTO of five hours and an RPO of one day. Which of the following would meet this requirement?
A. Ensure the system can be restored within five hours and ensure it does not lose more than one day of data.
B. Ensure the system can be restored within one day and ensure it does not lose more than five hours of data.
C. Ensure the system can be restored between five hours and one day after an outage.
D. Ensure critical systems can be restored within five hours and noncritical systems can be restored within one day.
Can you answer the question? More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Recovery Time Objective
The recovery time objective (RTO) identifies the maximum amount of time it can take to restore a system after an outage. Many BIAs identify the maximum acceptable outage or maximum tolerable outage time for critical services or business functions. If an outage lasts longer than this maximum time, the impact is unacceptable to the organization.
For example, imagine an organization that sells products via a web site generates $10,000 in revenue an hour. It might decide that the maximum acceptable outage for the web server is five minutes. With this in mind, the RTO is five minutes, indicating any outage must be limited to less than five minutes.
On the other hand, the organization may have a database server used by internal employees. Although the database server may be valuable, it is not critical. Management might decide they can accept an outage for as long as 24 hours, dictating an RTO less than 24 hours.
Recovery Point Objective
A recovery point objective (RPO) identifies a point in time where data loss is acceptable. As an example, a server may host archived data that has very few changes on a weekly basis. Management might decide that some data loss is acceptable, but they always want to be able to recover data from at least the previous week. In this case, the RPO is one week.
With an RPO of one week, administrators would ensure that they have at least weekly backups. In the event of a failure, they will be able to restore recent backups and meet the RPO.
In some cases, the RPO is up to the minute of the failure. For example, any data loss from an online database recording customer transactions might be unacceptable. In this case, the organization can use a variety of techniques to ensure administrators can restore data up to the moment of failure.
Remember this
The recovery time objective (RTO) identifies the maximum amount of time it should take to restore a system after an outage. It is derived from the maximum allowable outage time identified in the BIA. The recovery point objective (RPO) refers to the amount of data you can afford to lose.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Q. You are helping implement your company’s business continuity plan. For one system, the plan requires an RTO of five hours and an RPO of one day. Which of the following would meet this requirement?
A. Ensure the system can be restored within five hours and ensure it does not lose more than one day of data.
B. Ensure the system can be restored within one day and ensure it does not lose more than five hours of data.
C. Ensure the system can be restored between five hours and one day after an outage.
D. Ensure critical systems can be restored within five hours and noncritical systems can be restored within one day.
Answer is A. The recovery time objective (RTO) identifies the maximum amount of time it should to take to restore a system after an outage.
The recovery point objective (RPO) refers to the amount of data you can afford to lose.
RTO only refers to time, not data. RPO refers to data recovery points, not time to restore a system.
