The target time within which a disrupted activity or system must be restored after an incident.
The Recovery Time Objective sets how quickly a critical activity needs to be back in operation after a disruption. It is derived from the Business Impact Analysis and reflects the point at which the impact of being down becomes unacceptable.
RTO drives the choice of recovery strategy: a very short RTO usually demands more investment, such as standby systems, while a longer one allows simpler arrangements.
Related frameworks
KaitoSec