Derive RTO and RPO from the business, then check you can meet them

applied · 80 min · Objective 5.2

Task

Run a small business impact analysis, derive recovery objectives from it, and then measure whether your current capability meets them. The gap between the stated objective and the measured capability is the BIA's most actionable output.

Steps

  1. List four business functions your lab estate could be said to support, and for each write the impact of losing it at one hour, one day and one week. Note where the impact is not linear — a deadline, a reporting obligation, a payroll date.
  2. From the impact curve, derive an RTO and an RPO for each function, in business terms. Write the REASONING, not just the number.
  3. Map each function to the systems and data it depends on, including the dependencies people forget: identity, DNS, the backup system itself, and any third party.
  4. Now measure the current capability: from the Domain 3 labs you have a measured failover time and a measured restore time. Where you have no measurement, say so rather than estimating.
  5. Compare objective against capability for each function and mark it met or not met.
  6. For every unmet objective, write the change that would close it and its rough cost, so the business can decide between paying for the capability and revising the objective. Both are legitimate outcomes.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/bia.csv')))
assert len(rows)>=4, 'fewer than four functions'
unmet=0
for r in rows:
    for k in ('rto_target','rpo_target','rto_measured','rpo_measured'):
        assert r[k].strip(), '%s missing for %s' % (k, r['function'])
    if r['rto_measured'].strip().lower()!='not measured':
        if float(r['rto_measured'])>float(r['rto_target']): unmet+=1
    assert r['reasoning'].strip(), 'no reasoning for '+r['function']
print('%d functions, %d RTO objective(s) not met by measured capability' % (len(rows),unmet))
assert any('not measured' in r['rto_measured'].lower() or float(r['rto_measured'])>0 for r in rows), \
    'no measurements at all'
PY
grep -ciE "not linear|deadline|cost|revise the objective" /tmp/bia-notes.md

Every function must carry a target AND a measurement, and 'not measured' is an accepted value — it is an honest one, and pretending to a figure you have not measured is how an RTO becomes a number in a document that nobody has tested. The count of unmet objectives is the output.

Notes

Both ways of closing a gap are legitimate and the exam expects you to know it. An RTO of four hours with a measured capability of eleven is either an investment decision or a wrong objective, and the organisation has to choose consciously — which it cannot do until somebody measures.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.