(ISC)2 Certified in Cybersecurity Practice Exam

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

1. RTO

2. Recovery Point Objective (RPO)

3. Mean Time To Recovery (MTTR)

4. Service Level Agreement (SLA)

The correct answer is: Recovery Point Objective (RPO)

The Recovery Point Objective (RPO) is the metric that defines the maximum acceptable amount of data loss measured in time. It indicates how much data, in terms of time, an organization can afford to lose in the event of a disruption. For example, if an organization has an RPO of four hours, this means that in the event of a failure, they are willing to lose up to four hours' worth of data. RPO helps organizations design their backup and data protection strategies to ensure that they can restore systems and data to a point that is acceptable to their business operations. In contrast, Recovery Time Objective (RTO) focuses on how quickly systems must be restored after a disruption, not on the acceptable data loss itself. Mean Time To Recovery (MTTR) is related to the average time required to recover a system after a failure, which also does not address data loss. Lastly, a Service Level Agreement (SLA) is a broader agreement between a service provider and a customer that outlines the expected service standards, which may include RPO and RTO among other performance metrics, but does not specifically define the metrics themselves. This clarity helps organizations prioritize and manage their data recovery strategies effectively.