Which statement correctly defines RTO?

• A. The maximum acceptable data loss in time.
• B. The time window to complete data backups.
• C. The maximum acceptable downtime before services must be restored.
• D. The time required to encrypt data at rest.

Answer: (C)

RTO is the maximum amount of downtime you can tolerate for a service after a disruption, and it defines the deadline by which that service must be restored to keep business operations running. The statement that describes the maximum acceptable downtime before services must be restored matches this idea exactly, and it’s what sets the target window for recovery efforts, guides how you design failover, backups, and redundancy, and helps prioritize how quickly different systems need to come back online.

It’s useful to contrast this with RPO, which is about data loss tolerance—how much data you’re willing to lose, measured in time. The backup window describes how long you allocate to complete backups, not how quickly a service must be back up after an outage. Encrypting data at rest concerns protecting data, not the timing of service recovery after disruption.

For example, if the RTO is two hours, the recovery plan should ensure the affected service is operational within two hours of an outage.