Loading page
RTO and RPO are the two metrics at the heart of disaster recovery, and the exam loves to test whether you can tell them apart. One is about time to recover; the other is about how much data you can afford to lose.
Last updated July 2026
| Aspect | RTO | RPO |
|---|---|---|
| Full name | Recovery Time Objective | Recovery Point Objective |
| Question it answers | How long can we be down? | How much data can we afford to lose? |
| Measures | Time to restore service after an outage | Time between backups (acceptable data loss) |
| Direction | Looks forward from the incident to recovery | Looks back from the incident to the last good backup |
| Driven by | How long the business can tolerate downtime | How much data the business can tolerate losing |
| Lowering it needs | Faster recovery: hot sites, redundancy, automation | More frequent backups or continuous replication |
RTO is about time: how fast you must be back up. RPO is about data: how far back your last usable backup can be. A four-hour RTO means restore within four hours; a one-hour RPO means lose at most one hour of data, so back up at least hourly. Both come out of the business impact analysis.
Reading the difference is a start. SecPlus Mastery drills it with over 1,000 practice questions, timed mock exams, and spaced review across all five SY0-701 domains, so it sticks for exam day.
Written to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.