CISSP GLOSSARY · BUSINESS CONTINUITY
Recovery Time Objective (RTO)
The maximum time a business process can be down before recovery must complete. A CISSP Domain 7 metric: RTO plus WRT must fit inside the Maximum Tolerable Downtime (MTD).
The Recovery Time Objective is the clock that starts when a disruption begins: how long the organisation can tolerate the system being down before it must be restored. It is set by the business through the Business Impact Analysis, not by IT, which is a distinction CISSP questions test directly.
Place it on the timeline the exam uses. MTD (Maximum Tolerable Downtime) is the outer boundary for the whole outage. RTO covers getting the system itself back. WRT (Work Recovery Time) covers verifying data and resuming normal processing after the system is up. RTO + WRT must fit inside MTD, and RPO (Recovery Point Objective) is the separate, data-loss axis measured backwards from the disruption.
Exam relevance: scenario questions give you numbers and ask whether a recovery strategy is adequate, or ask which metric a described requirement defines. Do not confuse RTO (time to restore) with RPO (data you can afford to lose); that swap is the most common distractor in Domain 7 questions.