A security analyst is conducting a Business Impact Analysis (BIA) for a hospital system's critical Single Sign-On (SSO) and Patient Identity service. The assessment establishes that the system can tolerate a maximum data loss window of 15 minutes for active user session state logs, but the authentication service itself must be restored to full operation within 2 hours of an outage to prevent severe clinical delays. Which of the following statements correctly align these parameters with Business Continuity Management (BCM) metrics? (Select TWO.)
- The maximum acceptable data loss timeframe of 15 minutes defines the Recovery Point Objective (RPO).Answer
- The target restoration timeframe of 2 hours for service functionality defines the Recovery Time Objective (RTO).Answer
- CThe 2-hour target restoration duration represents the Recovery Point Objective (RPO) for system availability.
- DDeploying redundant SSO servers in an active-active load balanced cluster is classified as a corrective security control.
Answer
The maximum acceptable data loss timeframe of 15 minutes defines the Recovery Point Objective (RPO), and the target restoration timeframe of 2 hours for service functionality defines the Recovery Time Objective (RTO).
Recovery Point Objective (RPO) defines the maximum tolerable data loss window (15 minutes in this scenario), representing how far back data recovery must go. Recovery Time Objective (RTO) defines the targeted timeframe to restore business operations or systems following an outage (2 hours in this scenario). Both statements accurately map the BIA metrics to the organizational parameters.
Step-by-Step Solution
Key Concept
Distinction between Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
Estimated Time:1m 30s