During a disaster recovery review, a risk practitioner finds that the recovery objectives for a trading platform are documented only as a single number of hours. The practitioner needs to confirm how much transaction data the business can afford to lose if the platform fails, so that backup arrangements can be checked against it. Which recovery objective expresses the maximum acceptable amount of data loss?
- AThe recovery time objective, because it sets the maximum period the trading platform may remain unavailable before the loss to the business becomes unacceptable to senior management.
- BThe maximum tolerable downtime, because it captures the outer limit of disruption that the business can absorb before the consequences of losing the platform turn severe.
- CThe service delivery objective, because it states the reduced level of processing the trading platform must sustain while operating in its alternate recovery mode after a disruption.
- DThe recovery point objective, because it defines the maximum period of data that may be lost, fixing how far back the platform must be recoverable from the moment of disruption. Correct
Why A is wrong: This is tempting because both objectives are measured in time, but the recovery time objective governs how long restoration may take, not the volume of data that may be lost in a failure.
Why B is wrong: This is plausible because it bounds disruption, but maximum tolerable downtime concerns the duration of an outage rather than the quantity of data that can be lost when the platform fails.
Why C is wrong: This is attractive because it sounds like a recovery target, but the service delivery objective describes a degraded service level during recovery, not the amount of data the business may lose.
Why D is correct: The recovery point objective sets the tolerable data loss by defining the point in time to which data must be restored, so it is the objective the practitioner should check against the backup arrangements.