Business continuity, RTO, and RPO for ISC
Separate recovery time from recoverable data loss, test both objectives, and connect the result to backup and restoration controls.
The decision that earns the point
Identify the objective before choosing the control
Recovery time objective is the target time to restore a service after disruption. Recovery point objective is the maximum targeted data-loss interval measured backward from disruption. A recovery design must support both objectives, not just one.
Exam use
ISC can ask whether backup frequency supports RPO, whether recovery capacity supports RTO, and whether actual test results meet the stated objectives.
Your scratch-paper plan
Solve it in three moves
- 1
Read the objective
Separate the maximum targeted outage from the maximum targeted data-loss interval.
NIST SP 800-34 Rev. 1: Contingency Planning Guide - 2
Test the design
Compare recovery resources with RTO and backup or replication frequency with RPO.
NIST SP 800-34 Rev. 1: Contingency Planning Guide - 3
Compare actual results
Use exercise timestamps and recovered data to determine whether each objective was met.
NIST SP 800-34 Rev. 1: Contingency Planning Guide
Worked problem
Work the facts before choosing the answer
Payroll has an eight-hour RTO and two-hour RPO. A recovery test restores service in six hours from a backup taken five hours before the outage.
CPAPass original exam illustration using stated assumptions
Show the work
The six-hour recovery meets the eight-hour RTO. The five-hour data gap exceeds the two-hour RPO.
Rule source: NIST SP 800-34 Rev. 1: Contingency Planning GuideAnswer
Time recovery passed, but the data recovery objective failed. Increase backup or replication frequency and retest restoration.
Rule source: NIST SP 800-34 Rev. 1: Contingency Planning GuideDo it now
Test the same decision with a fresh question
Start with free ISC practice. Create an account only when you want the 5-day no-card CPAPass trial and continued section practice.
The trap and the repair
Common trap
Treating RTO and RPO as two names for downtime hides the separate data-loss requirement.
Repair
Draw one arrow forward from disruption for RTO and one arrow backward from disruption for RPO.
Recovery timeline
Measure service restoration and data recovery separately
One recovery test can pass its time objective and fail its data objective. Record both results.
| Measure | Question to ask | Evidence | Authority |
|---|---|---|---|
| RTO | How long may the service remain unavailable? | Disruption time, restoration time, tested capacity | NIST SP 800-34 Rev. 1: Contingency Planning Guide |
| RPO | How much data loss is tolerable? | Last recoverable point, backup or replication interval | NIST SP 800-34 Rev. 1: Contingency Planning Guide |
| Recovery test | Did actual time and restored data meet both targets? | Exercise log, restoration proof, exception and corrective action | NIST SP 800-34 Rev. 1: Contingency Planning Guide |
After a miss
Repair an RTO-versus-RPO miss
- 1
Draw the outage time and mark the service-restoration point to test RTO.
- 2
Mark the last recoverable data point before the outage to test RPO.
- 3
Change only the backup interval, then only the restoration time, and identify which objective changes.
Your exam workflow
- Step 1Read the requirementIdentify what the task asks you to decide about business continuity cpa exam isc.2026 Uniform CPA Examination Blueprints
- Step 2Sort the factsSeparate the maximum targeted outage from the maximum targeted data-loss interval.NIST SP 800-34 Rev. 1: Contingency Planning Guide
- Step 3Apply the ruleCompare recovery resources with RTO and backup or replication frequency with RPO.NIST SP 800-34 Rev. 1: Contingency Planning Guide
- Step 4Check the outputUse exercise timestamps and recovered data to determine whether each objective was met.NIST SP 800-34 Rev. 1: Contingency Planning Guide
Keep the next step narrow
Quick questions
What is the shortest useful answer for business continuity cpa exam isc?
Recovery time objective is the target time to restore a service after disruption. Recovery point objective is the maximum targeted data-loss interval measured backward from disruption. A recovery design must support both objectives, not just one.
How can business continuity cpa exam isc appear on the CPA Exam?
ISC can ask whether backup frequency supports RPO, whether recovery capacity supports RTO, and whether actual test results meet the stated objectives. The exact task can change, so identify the governing facts before applying the rule.
What is the most common mistake with business continuity cpa exam isc?
Treating RTO and RPO as two names for downtime hides the separate data-loss requirement. Draw one arrow forward from disruption for RTO and one arrow backward from disruption for RPO.
Where should I practice business continuity cpa exam isc?
After the worked example, use ISC practice for a fresh question that requires the same decision. If the miss depends on it general controls that support recoverability, review that handoff before trying another set.
How should I review business continuity cpa exam isc after a missed question?
Draw the outage time and mark the service-restoration point to test RTO. Mark the last recoverable data point before the outage to test RPO. Change only the backup interval, then only the restoration time, and identify which objective changes.