Maximum Tolerable Downtime (MTD)

D.

The Maximum Tolerable Downtime (MTD) is the maximum length of time a BUSINESS FUNCTION can endure without being restored, beyond which the BUSINESS is no longer viable - NIST SAYS: The ISCP Coordinator should analyze the supported mission/business processes and with the process owners, leadership and business managers determine the acceptable downtime if a given process or specific system data were disrupted or otherwise unavailable.

Downtime can be identified in several ways.

Maximum Tolerable Downtime (MTD)

The MTD represents the total amount of time the system owner/authorizing official is willing to accept for a mission/ business process outage or disruption and includes all impact considerations.

Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.

Other BCP and DRP terms you must be familiar with are: Recovery Time Objective (RTO)

RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD.

Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD.When it is not feasible to immediately meet the RTO and the MTD is inflexible, a Plan of Action and Milestone should be initiated to document the situation and plan for its mitigation.

Recovery Point Objective (RPO)

The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered (given the most recent backup copy of the data) after an outage.

Unlike RTO, RPO is not considered as part of MTD.

Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process.Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD.

For example, a system outage may prevent a particular process from being completed, and because it takes time to reprocess the data, that additional processing time must be added to the RTO to stay within the time limit established by the MTD.

References used for this question: KRUTZ, Ronald L.

& VINES, Russel.

D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Page 276

and http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf.

The Maximum Tolerable Downtime (MTD) refers to the maximum amount of time that an organization can tolerate a system or service being down or unavailable without suffering significant consequences. It is the time duration during which an organization can survive or continue to function with an acceptable level of disruption.

Option D is a partial definition of MTD. MTD is the maximum amount of time that an organization can experience an outage or disruption to its systems or services, and still remain operational. It is not a delay, but rather a measure of the time that an organization can be without critical systems or services before it begins to suffer significant losses, such as revenue, reputation, or customer satisfaction.

Option A is incorrect because it refers specifically to the recovery of application data, rather than the downtime itself. MTD includes the time it takes to recover the system or service, but it is not limited to just that recovery time.

Option B is also incorrect because it refers to the minimum elapsed time required to complete recovery, rather than the maximum amount of downtime that an organization can tolerate. MTD is concerned with the maximum amount of time that an organization can tolerate, not the minimum time required for recovery.

Option C is incorrect because it refers to the time required to move back to the primary site after a major disruption, which is a specific scenario that may or may not apply to an organization. MTD is a broader concept that applies to any disruption or outage, regardless of the cause.

In summary, MTD is the maximum amount of time that an organization can tolerate a system or service being down or unavailable without suffering significant consequences, and it is a critical component of any organization's disaster recovery and business continuity planning.