ISO 22301 FAQ MTPD

MTPD is the name ISO 22301 permits for the timeframe within which the impacts of not resuming an activity would become unacceptable. This is more precise than treating MTPD as elapsed outage time alone: the decision depends on impact types, impact criteria, the affected activity, and how impacts develop over time.

A useful MTPD record names the activity, the product or service it supports, the impact criteria used, the point where impact becomes unacceptable, and the person or forum that accepted that tolerance. Without that context, the number is hard to defend during an audit, supplier review, or real disruption.

MTPD is the unacceptable-impact boundary. RTO is the prioritized timeframe for resuming the disrupted activity at a specified minimum acceptable capacity, and it should sit inside the MTPD. ISO 22301:2019 does not define or explicitly require RPO; an organization can use RPO as a supporting data-loss or transaction-rework target where information recovery affects continuity.

If an activity has a 48-hour MTPD, setting a 48-hour RTO leaves no margin for activation delays, failed recovery steps, supplier dependencies, or management escalation. The BIA should therefore show why the selected RTO and resource strategy can recover the activity before the MTPD is reached.

Connect the MTPD to the BIA rather than leaving an unexplained number in a spreadsheet. A reviewer should be able to trace the activity to the product or service it supports, impact criteria, impacts over time, RTO, required resources, dependencies, continuity strategy, exercise results, and open actions. Include RPO only where the organization uses it as a supporting data-recovery target.

Good evidence also shows ownership. The business owner should approve the impact tolerance, continuity or resilience teams should challenge consistency across activities, and management review should see unresolved gaps where recovery capability cannot meet the agreed time frames.

Review MTPD at planned intervals and whenever the facts behind the BIA change. Typical triggers include a new or changed product, site, process, system, supplier, customer promise, legal or contractual duty, incident lesson, failed exercise, resource constraint, or management decision that changes impact tolerance.

The update should not stop at the MTPD field. If the tolerance changes, check whether RTOs, RPOs, continuity strategies, resource requirements, procedures, supplier agreements, exercises, and management-review actions still make sense.