An established point in time to which the disrupted asset or component should be restored is called what?

• A. Recovery Time Objective (RTO)
• B. Recovery Point Objective (RPO)
• C. Residual Risk
• D. Regulatory Policies

Answer: (B)

Recovery Point Objective defines the point in time to which data must be restored after a disruption. It answers how far back in time the organization is willing to go and what amount of data loss is acceptable. It’s measured as the maximum tolerable data loss, typically expressed in minutes or hours. For example, if the RPO is 4 hours, you should be able to restore data to the state it was in up to four hours before the incident; any data since then could be lost. This focus on data currency distinguishes it from the Recovery Time Objective, which concerns how long systems can be down before business impact becomes unacceptable. Residual risk is the remaining risk after controls, and regulatory policies are rules or standards, not restoration targets.