Business continuity · BIA

RTO, RPO and MTPD: three values, three different decisions

RTO describes the target time until recovery, RPO the tolerated data loss and MTPD the outer limit of the outage.

9 minute read · Content as of 14.10.2026

What does MTPD mean?

MTPD stands for Maximum Tolerable Period of Disruption. It is the span after which the consequences of an outage become unacceptable for the organisation, because contractual deadlines lapse, legal obligations are breached or the damage threatens its survival. BSI Standard 200-4 uses the term maximal tolerierbare Ausfallzeit (MTA) for the same limit.

The business side sets the MTPD per business process in the business impact analysis. It is not a technical figure but the boundary from which RTO and RPO are derived: the RTO has to sit well before the MTPD so that recovery completes with a margin.

What does RTO mean?

RTO stands for Recovery Time Objective. It sets the time within which a process or resource has to be running again after a disruption, at least at an emergency level. BSI Standard 200-4 calls it the Wiederanlaufzeit (WAZ).

The RTO is a target the organisation sets for itself, and it sits with a margin before the MTPD. For IT systems, the process RTO determines by when applications, data and interfaces have to be restored. Only a recovery test shows whether that works.

What does RPO mean?

RPO stands for Recovery Point Objective, the maximum tolerable data loss. It describes how far back the restored data may lie: with an RPO of four hours, at most the changes of the last four hours may be lost.

The RPO therefore drives the backup interval and the replication method. A nightly backup does not fit an RPO of one hour, however fast the restore itself is.

The terms must not be interchangeable

The maximum tolerable period of disruption sets the business limit. The RTO sits before it and describes the recovery target. The RPO answers a different question: which state of the data must it be possible to return to?

An example: three values for one process

Suppose the business unit finds in the BIA that order intake breaches contractual deadlines after a 48-hour outage. The MTPD is then 48 hours. An RTO of 24 hours leaves a margin for alerting, decisions and rework. Because lost orders can hardly be reconstructed, the business unit sets the RPO at one hour.

Each value makes a different demand: the RTO needs a tested recovery plan, the RPO a matching backup or replication concept, the MTPD a limit that priorities and escalation are aligned to.

Targets must fit together technically and organisationally

An RTO of four hours is worthless if decisions, alternate workplaces or supplier commitments only become available after a day. Requirements are therefore checked against existing capabilities and documented as gaps.