nerdexam
Isaca

CISM · Question #787

An organization requires that business-critical applications be recovered within 30 minutes in the event of a disaster. Which of the following metrics should be in the business continuity plan (BCP)…

The correct answer is D. Recovery time objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business function or system following a disruption. If the organization requires recovery in 30 minutes, that is the system's RTO. This metric guides the selection of technologies, staffing, and…

Submitted by ricky.ec· Apr 18, 2026Information Security Program Development and Management

Question

An organization requires that business-critical applications be recovered within 30 minutes in the event of a disaster. Which of the following metrics should be in the business continuity plan (BCP) to manage this requirement?

Options

  • AMaximum tolerable downtime (MTD)
  • BService level agreement (SLA)
  • CRecovery point objective (RPO)
  • DRecovery time objective (RTO)

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    3% (1)
  • D
    87% (27)

Explanation

The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business function or system following a disruption. If the organization requires recovery in 30 minutes, that is the system's RTO. This metric guides the selection of technologies, staffing, and procedures needed to meet recovery expectations. "RTO defines the target time set for the recovery of IT and business activities after a disruption. It is a key BCP design parameter."

Topics

#Business Continuity Plan#Recovery Time Objective#Disaster Recovery#Application Recovery

Community Discussion

No community discussion yet for this question.

Full CISM Practice