ISO 22301 FAQ RTO

RTO means recovery time objective: the target timeframe for resuming a disrupted activity at a specified minimum acceptable capacity. ISO 22301 places it inside the business impact analysis, after the organization has assessed impacts over time and identified the maximum tolerable period of disruption.

The RTO must be set within the unacceptable-impact timeframe, which the standard notes may be called MTPD. Setting both to the same value leaves no planned margin for activation, failed steps, verification, or dependency delays, so any equal values need a defensible impact and capability rationale.

Start from impact, not from available technology. The BIA should define impact types and criteria, identify activities that support products and services, assess the impacts over time, and identify when not resuming the activity becomes unacceptable.

After that, set prioritized timeframes for resuming disrupted activities at minimum acceptable capacity. That is where the RTO belongs. The record should also identify the resources, partners, suppliers, and interdependencies required to meet the target.

RTO is about the time to resume an activity at minimum acceptable capacity. RPO is a separate supporting target for the point to which information should be recovered and the resulting data loss or rework. ISO 22301:2019 does not define or explicitly require RPO, although organizations often use it where information recovery affects continuity.

For example, a customer portal might need to be usable within a few hours, while some reporting data can be restored to the last completed batch. A payment, safety, clinical, or operational-control process might need both a short RTO and a strict RPO. The BIA should make that distinction explicit.

Evidence should show that the selected strategy and solution, plan, resources, dependencies, and exercise results can support resumption within the RTO at the agreed capacity. Measure from the defined disruption or activation trigger and state when the minimum acceptable capacity was reached; otherwise actual recovery times cannot be compared consistently.

Useful evidence includes the BIA record, approved recovery strategy, continuity plan, dependency map, resource requirements, supplier commitments, exercise scenario, post-exercise report, corrective actions, and management review decisions.

Review RTOs at planned intervals and whenever the organization, service, supplier, technology, legal context, customer commitment, or disruption experience changes. ISO 22301 ties BIA and risk assessment review to planned intervals and significant changes.

The most common failure is leaving the RTO unchanged after the business changes. A new customer promise, cloud architecture, supplier dependency, product launch, staffing model, or exercise failure can all make the previous target unrealistic or too weak.