SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-rto-definition

In disaster recovery, what does the Recovery Time Objective (RTO) measure?

The maximum time a system can stay unavailable before the impact becomes unacceptable.

Start playing free

  1. How much data you can afford to lose
  2. How often backups must be tested
  3. Maximum downtime before the impact is unacceptable ✔

Why: RTO is about time: how long recovery can take. It helps pick technologies, such as hot standby or restore from tape, that can meet the target. Data loss tolerance is a different measure called RPO.

Huh, didn't know that: NIST says that if the RTO cannot be met right away and the MTD is firm, a Plan of Action and Milestones should be started.

The dad joke
My RTO is short, but my coffee RTO is even shorter.
Like this card?
Play the game

References

Answer: Maximum downtime before the impact is unacceptable. RTO is about time: how long recovery can take. It helps pick technologies, such as hot standby or restore from tape, that can meet the target. Data loss tolerance is a different measure called RPO.

  1. NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
    RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyHow should a system's Recovery Time Objective compare with its Maximum Tolerable Downtime?Security & PrivacyIn disaster recovery, what does the Recovery Point Objective (RPO) describe?Security & PrivacyTo restore from differential backups, which backup sets do you need?

That's stuff everyone should know.