CISSP GLOSSARY · BUSINESS CONTINUITY
Work Recovery Time (WRT)
The time after a system is technically restored spent verifying data, reconciling records, and resuming normal processing. RTO plus WRT must fit inside the MTD.
Work Recovery Time is the phase everyone forgets: getting the system back online is not the same as being back in business. WRT covers the work that happens after RTO ends, once the infrastructure is technically up: restoring and validating data, reconciling transactions that were in flight, testing that the application behaves, and letting users resume normal processing.
On the recovery timeline, RTO and WRT sit end to end inside the outer boundary. RTO restores the system; WRT makes it trustworthy and operational; and their sum must not exceed the Maximum Tolerable Downtime. Squeeze one and you must expand the other, or breach the MTD. This is the detail that separates candidates who memorised four acronyms from those who understand the timeline, laid out in full in the recovery metrics guide.
Exam relevance: the classic trap gives you an RTO and an MTD and asks for the allowable WRT, or describes “validating data and resuming operations after the system came back” and asks which metric applies. The equation to hold is simple: RTO + WRT must be less than or equal to MTD.