Cybersecurity definition
What is RTO / RPO?
RTO / RPO stands for Recovery Time Objective / Recovery Point Objective.
By Cyber Tool Stack Editorial TeamUpdated
Definition
Two targets that define how much disaster an organization can tolerate: RTO is how long systems can be down before recovery, and RPO is how much data — measured in time — can be lost since the last good backup.
Where RTO / RPO fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
Immutable BackupA backup copy stored so it cannot be modified, encrypted, or deleted for a set retention period — even by an administrator account — guaranteeing a clean recovery point survives even if ransomware compromises the backup system itself.Tabletop ExerciseA discussion-based walkthrough of a simulated incident, where stakeholders talk through their planned response step by step, used to find gaps in an incident response plan before a real breach forces the issue.3-2-1 Backup RuleA backup best practice: keep at least three copies of your data, on two different types of media, with one copy stored offsite. The modern 3-2-1-1-0 variant adds one offline or immutable copy and zero recovery errors — meaning restores are regularly tested and confirmed to work.