CISSP Practice Question: Is developing a business continuity plan (BCP)

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Recovery Time Objective (RTO)

  Why this is correct

  Recovery Time Objective (RTO) is a crucial metric in business continuity planning, representing the maximum tolerable period of time following a disaster or disruption during which a business process or system can be unavailable before unacceptable consequences occur. It dictates how quickly systems and applications must be restored to an operational state to meet defined business requirements. Establishing a precise RTO guides the selection of appropriate recovery strategies and technologies, ensuring alignment with organizational resilience goals.

• ✗

  Recovery Point Objective (RPO)

  Why it's wrong here

  Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate following a disruption or outage. It determines the point in time to which data must be recovered, meaning any data created or modified after that specific point would be irretrievably lost. Unlike RTO, which focuses on system availability and operational uptime, RPO specifically addresses data integrity and the permissible window for data loss.

• ✗

  Mean Time to Repair (MTTR)

  Why it's wrong here

  Mean Time to Repair (MTTR) is an operational metric that calculates the average time required to diagnose, repair, and restore a failed system or component to full functionality. While it indicates the efficiency of an organization's maintenance and incident response processes, MTTR is an average measurement of actual repair times, not a pre-defined maximum acceptable downtime established during business continuity planning. It reflects historical performance rather than a forward-looking objective for recovery.

• ✗

  Mean Time Between Failures (MTBF)

  Why it's wrong here

  Mean Time Between Failures (MTBF) is a reliability metric that represents the predicted elapsed time between inherent failures of a system during normal operation. It quantifies the expected operational uptime of a system before it fails again, indicating its reliability and expected lifespan. MTBF is primarily used for maintenance scheduling, assessing system robustness, and predicting component longevity, but it does not define the maximum acceptable period of unavailability after a failure occurs.

• ✗

  Service Level Agreement (SLA)

  Why it's wrong here

  A Service Level Agreement (SLA) is a contractual agreement between a service provider and a customer that formally defines the level of service expected, including metrics like uptime, performance, and support response times. While an SLA might contain clauses related to recovery objectives and penalties for non-compliance, it is fundamentally a legal document outlining service expectations and commitments, not a specific technical metric like maximum acceptable downtime itself. It represents the agreed-upon service commitment.