RTO, RPO and MTD Explained for CISA and CISM

2026-10-19

Recovery objectives appear in both exams, usually inside a scenario. Getting them straight earns easy marks.

The three terms

• Maximum tolerable downtime (MTD): the longest a business process can be unavailable before the damage becomes unacceptable.
• Recovery time objective (RTO): the target time to restore the process or system after a disruption. It must be shorter than or equal to the MTD.
• Recovery point objective (RPO): the maximum acceptable data loss, measured in time. An RPO of one hour means you can lose at most one hour of transactions.

How they fit together

Think of a timeline around a disruption:

• Looking backward from the disruption is the RPO: how far back the last good copy of data may be.
• Looking forward from the disruption is the RTO: how long until service is back.
• The MTD is the outer limit the RTO must sit within.

Who sets them

The business process owner sets recovery objectives, based on a business impact analysis. IT designs solutions to meet them. On the exam, an option where IT sets the RTO based on what servers can do is a trap.

What drives what

• RPO drives backup and replication frequency. Nightly backups cannot meet a one-hour RPO.
• RTO drives the recovery strategy. Very short RTOs need hot sites or active-active designs; long RTOs can use warm or cold sites.
• Shorter objectives cost more. Strategy should meet the objective without greatly exceeding it.

Classic exam scenarios

1. Nightly backups, one-hour RPO. The issue is potential data loss far beyond tolerance.
2. Recovery test took eight hours against a four-hour RTO. Analyze causes, then update the plan, resources or — with business approval — the RTO, and retest.
3. Replication lag of two hours, RPO of 30 minutes. Actual capability does not meet the objective.
4. Synchronous replication protects everything. No: it replicates corruption and ransomware too. You still need point-in-time backups.

Quick self-test

• Which objective tells you how often to back up? RPO.
• Which must be shorter: RTO or MTD? RTO.
• Who approves the RTO? The business owner.

Related on Auditor Path

• Recovery time objective (RTO)
• Recovery point objective (RPO)
• Maximum tolerable downtime (MTD)
• Business impact analysis explained

Sources

ISACA CISA and CISM exam content outlines (business continuity, disaster recovery and BIA subtopics).