Glossary
Recovery time objective (RTO)
The maximum acceptable time to restore a business process or system after a disruption, set by the business and used to design recovery.
The recovery time objective (RTO) is the target maximum duration within which a business process or system must be restored after a disruption to avoid unacceptable consequences. It is usually set through a business impact analysis and approved by the business owner, not by IT alone.
RTO is often paired with the recovery point objective (RPO): the maximum acceptable amount of data loss, measured as the time between the last usable backup or replica and the disruption. A service with an RPO of one hour needs backups or replication at least hourly.
Cyber incidents stress RTOs in ways other outages do not. After ransomware, for example, restoring may require rebuilding infrastructure, validating that backups are clean and resetting credentials before data can be restored, which can take far longer than a routine restore test suggests.
Tabletop exercises should ask whether RTOs are documented, agreed and, above all, grounded in tested restore times. See the ransomware scenario and the DDoS scenario.