In disaster recovery planning, what does RTO specify?

• A. Maximum acceptable data loss.
• B. Security policy compliance.
• C. Hardware replacement timetable.
• D. Maximum acceptable downtime.

Answer: (D)

RTO is the maximum downtime a business process can tolerate after a disruption. It sets the target time by which services must be restored or made operational again, guiding the speed and methods of recovery (such as failover, backups, or rebuilding systems). For example, if the RTO is four hours, the recovery plan is designed to bring the process back up within that four-hour window to avoid unacceptable impact.

This is different from the recovery point objective, which defines the latest acceptable point in time to which data must be restored—essentially, how much data you’re willing to lose. Security policy compliance isn’t about how long systems can be down, and hardware replacement timelines relate more to repair or MTTR (mean time to repair) rather than the allowable downtime defined by the RTO.