Recovery Time Objective
Encyclopedia
The recovery time objective (RTO) is the duration of time and a service level within which a business process
must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity
.
It includes the time for trying to fix the problem without a recovery (*NOT true in all organizations*), the recovery itself, tests and the communication to the users. Decision time for users representative is not included.
The business continuity timeline usually runs parallel with an incident management timeline and may start at the same, or different, points.
In accepted business continuity planning
methodology the RTO is established during the Business Impact Analysis (BIA) by the owner of a process (usually in conjunction with the business continuity planner). The RTOs are then presented to senior management for acceptance.
The RTO attaches to the business process and not the resources required to support the process.
The RTO and the results of the BIA in its entirety provide the basis for identifying and analyzing viable strategies for inclusion in the business continuity plan. Viable strategy options would include any which would enable resumption of a business process in a time frame at or near the RTO. This would include alternate or manual workaround procedures and would not necessarily require computer systems to meet the RTOs
The "O" in RTO stands for objective, not mandate. In reality, tactics are often selected that will not meet the RTO. In this instance the RTO will not be met but should still remain an objective of future strategy revision.
Business process
A business process or business method is a collection of related, structured activities or tasks that produce a specific service or product for a particular customer or customers...
must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity
Business continuity
Business continuity is the activity performed by an organization to ensure that critical business functions will be available to customers, suppliers, regulators, and other entities that must have access to those functions. These activities include many daily chores such as project management,...
.
It includes the time for trying to fix the problem without a recovery (*NOT true in all organizations*), the recovery itself, tests and the communication to the users. Decision time for users representative is not included.
The business continuity timeline usually runs parallel with an incident management timeline and may start at the same, or different, points.
In accepted business continuity planning
Business continuity planning
Business continuity planning “identifies [an] organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention and recovery for the organization, whilst maintaining competitive advantage and value system integrity”. It is also called...
methodology the RTO is established during the Business Impact Analysis (BIA) by the owner of a process (usually in conjunction with the business continuity planner). The RTOs are then presented to senior management for acceptance.
The RTO attaches to the business process and not the resources required to support the process.
The RTO and the results of the BIA in its entirety provide the basis for identifying and analyzing viable strategies for inclusion in the business continuity plan. Viable strategy options would include any which would enable resumption of a business process in a time frame at or near the RTO. This would include alternate or manual workaround procedures and would not necessarily require computer systems to meet the RTOs
The "O" in RTO stands for objective, not mandate. In reality, tactics are often selected that will not meet the RTO. In this instance the RTO will not be met but should still remain an objective of future strategy revision.
See also
- Recovery point objectiveRecovery point objective-Recovery point objective :When computers used for normal "production" business services are affected by a "Major Incident" that cannot be fixed quickly, then the Information Technology Service Continuity Plan is performed, by the ITSC recovery team...
(RPO) - Recovery Time ActualRecovery Time ActualRecovery time actual is used in conjunction with RTO.RTO is set by the supporting business line. This is usually done through a business impact analysis...
(RTA) - Recovery Consistency ObjectiveRecovery Consistency ObjectiveThe term recovery consistency objective is used in business continuity planning in addition to recovery point objective and recovery time objective . It applies data consistency objectives to continuous data protection services...
(RCO) - BS 25999BS 25999BS 25999 is BSI's standard in the field of Business Continuity Management . This standard replaces PAS 56, a Publicly Available Specification, published in 2003 on the same subject.-Structure:...