RTO vs RPO vs MTPD: Setting Recovery Objectives

RTO, RPO, and MTPD are the vocabulary of recovery planning. ISO 22301 expects continuity capabilities aligned to business needs from the BIA — not a universal numeric table.

Related: DR plan · BCP · Hub.

Definitions only: Never treat sample recovery times as ISO 22301 requirements. Your hours or days come from BIA impact analysis, risk appetite, and technical feasibility.

RTO — Recovery Time Objective

The target duration of time within which a product, service, activity, or resource must be recovered after disruption to avoid unacceptable consequences. Set from BIA priorities and validated in exercises.

RPO — Recovery Point Objective

The maximum acceptable data loss measured in time — how far back you can restore and still meet business needs. Driven by data criticality and backup / replication design, informed by the BIA.

MTPD — Maximum Tolerable Period of Disruption

The time after which the impact of not resuming an activity becomes unacceptable to the organisation. MTPD often frames how aggressive RTO must be (RTO should remain within MTPD).

How Organisations Set Values

Complete the BIA for in-scope activities
Agree impact thresholds with owners and leadership
Propose RTO / RPO / MTPD consistent with impact and cost
Engineer strategies (people, process, technology) that can meet them
Prove capability through clause 8.5 exercises

Illustrative Note (Not a Requirement)

Teams sometimes discuss recovery objectives in relative terms (tighter for payment clearing than for a low-priority intranet). Any numeric examples used in workshops are illustrative only and are not mandated by ISO 22301.

How CyberSilo Helps

BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
Advisory scoping for certification readiness — contact CyberSilo

Tie Objectives to Evidence

Record BIA-derived objectives and prove them with DR tests and continuity exercises in CSA.

Talk to CyberSilo ISO 22301 Hub

Frequently Asked Questions

Does ISO 22301 define mandatory RTO hours?

No. The standard requires a BCMS that meets your organisation’s needs. Numeric RTOs/RPOs/MTPDs are organisation-specific.

Can RTO exceed MTPD?

That would mean you plan to fail the activity’s maximum tolerable disruption — treat it as a critical design flaw to resolve.

Who approves the numbers?

Business owners propose; leadership accepts residual risk and funding implications.

BIA template · Exercises · Hub