Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Recovery Time Objective (RTO)?

Definition

A recovery time objective (RTO) is the maximum time a system or service can stay down after a disruption before the damage to the business becomes unacceptable. If your RTO for email is four hours, your backups, people, and procedures must be able to bring email back within four hours. It answers "how long can we be down?"

How It Works

NIST SP 800-34 Revision 1 defines RTO as "the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes," and the maximum tolerable downtime. It pairs RTO with two related measures:

  • Maximum tolerable downtime (MTD): the total outage leadership is willing to accept for a business process, counting all impacts. NIST says the RTO "must normally be shorter than the MTD," because work also has to be caught up after systems return.
  • Recovery point objective (RPO): how much data you can afford to lose, which is not part of the downtime calculation.

An RTO is set for each system through a business impact analysis, then the technology is chosen to meet it. A shop that can survive two days without its website can rely on a tested restore from backup. A practice that cannot book patients for more than an hour needs standby systems or a manual fallback. Restore speed matters too: in GitLab's 2017 database outage, copying the data back from slow, low-cost disks took around 18 hours, so test restores should be timed, not just checked for success.

Real-World Example

The British Library's March 2024 review, Learning lessons from the cyber-attack, describes an October 2023 attack claimed by the Rhysida ransomware gang. Besides stealing about 600GB of files and encrypting data, the attackers destroyed some servers "to inhibit system recovery." The Library had secure copies of its digital collections, but "the lack of viable infrastructure on which to restore it" became the bottleneck. Research services were severely restricted for the first two months, and a searchable online catalogue only returned on January 15, 2024. Many legacy applications could not be restored at all. Its cloud-based finance and payroll systems worked normally throughout.

Why It Matters for a Small Business

Every day offline costs a small business sales, staff time, and customer trust, and many find out their true recovery time during the incident. The British Library had backups of its data and still faced months of disruption, because the servers, software, and rebuild plan were not ready. CISA's small business backup guidance calls for scheduled recovery tests to refine RPOs and RTOs and confirm "your team can rapidly restore data both fully and partially." Writing an RTO down forces the question while there is still time to fix the answer.

How to Spot It / How DTS Handles It

Warning signs: nobody has timed a full restore, recovery depends on one person or one server, old software would not reinstall on new hardware, and the plan says "restore from backup" with no hours attached.

DTS can help with setting RTOs per system with you, timing restore tests against them, and documenting a fallback for anything that cannot be met. See our data recovery service.

Related Terms

  • Recovery point objective (RPO): how much data you can lose, the partner metric.
  • Backups and the 3-2-1 rule: the copies an RTO depends on.
  • Business continuity plan: how the business keeps running while systems are down.
  • Disaster recovery plan: the step-by-step restore plan built to meet each RTO.
  • Recovery: the incident stage your RTO measures.
  • Tabletop exercise: a low-cost way to test whether your RTOs are realistic.

Sources

  • NIST, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (2010, updated): https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final
  • British Library, Learning lessons from the cyber-attack: British Library cyber incident review (March 8, 2024): https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf
  • CISA, Back Up Business Data: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data
  • GitLab, Postmortem of database outage of January 31 (February 10, 2017): https://about.gitlab.com/blog/2017/02/10/postmortem-of-database-outage-of-january-31/

Last updated October 14, 2026.