Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
RTO, RPO, MTD and Recovery Prioritisation
Two questions after a disaster
After a disruption, two questions matter most:
- How much data can we afford to lose? The recovery point objective (RPO), looking back from the disaster to the last good copy.
- How fast must we be back? The recovery time objective (RTO), looking forward.
Both come from the BIA, and both must finish within the maximum tolerable downtime (MTD).
The definitions
| Objective | Meaning | Drives |
|---|---|---|
| RPO | Maximum acceptable data loss, measured in time | Backup and replication frequency |
| RTO | Maximum acceptable time to restore a system or process | Recovery strategy and site type |
| MTD | Longest a process can be down before damage is unacceptable | The upper limit for RTO |
| SDO (service delivery objective) | The reduced service level acceptable during recovery | Recovery capacity needed |
| MTO (maximum tolerable outage) | How long the organisation can run in recovery mode | How long alternate arrangements must last |
RTO must be shorter than MTD; some frameworks say MTD equals RTO plus the time needed to verify data and catch up on work.
Finding the right balance
As the allowed recovery time gets longer, the cost of downtime rises and the cost of recovery falls (a cold site is far cheaper than a mirrored one). The best strategy sits where the total is lowest. Very short RTOs and RPOs are only worth paying for when downtime is very expensive.
Recovery order
- Foundations first: network, identity, DNS and security tools.
- Critical applications, lowest RTO first.
- Data: restore and reconcile to the RPO.
- Other services, by priority.
Example. After a ransomware attack, the team restores the ERP first, as the BIA says, but users can’t log in: the identity service hasn’t been rebuilt. Four hours are lost. The DR plan is revised to restore identity, DNS and network services first.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Metric that sets backup frequency | RPO |
| Metric that sets the recovery site type | RTO |
| Relationship of RTO to MTD | RTO must be less than MTD |
| An RPO of zero requires… | Synchronous replication or mirroring |
| How to choose recovery targets | Balance the cost of downtime against the cost of recovery |
In short
- Recovery point objective (RPO): the maximum acceptable data loss, measured in time; it drives backup and replication frequency.
- Recovery time objective (RTO): the maximum acceptable time to restore a system or process; it drives the recovery strategy and site.
- Maximum tolerable downtime (MTD): the longest a process can be down before damage is unacceptable; RTO must be shorter than MTD.
- Service delivery objective (SDO) is the reduced service level acceptable during recovery; maximum tolerable outage (MTO) is how long you can run in that mode.
- Lower RTO and RPO cost more; the best strategy balances the cost of downtime against the cost of recovery.
- Recovery is prioritised by business criticality, respecting dependencies (identity and network before applications).
Exam traps
- RPO is about data (how far back); RTO is about time (how fast). Don't swap them.
- An RPO of zero needs synchronous replication; daily backups give up to 24 hours of loss.
- Shorter isn't automatically better; targets must be justified by the cost of downtime.
- Restoring applications before the identity service and network they depend on wastes time.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two questions after a disaster
Finding the right balance
1 / 8