MTPD, RTO, RPO: the three numbers at the heart of a BIA

Business continuity has a jargon problem, and these three acronyms are the ringleaders. But here is the secret: they are just three honest questions about each thing your business does. Answer them, and a Business Impact Analysis stops being homework and starts being a plan.

Let us use one running example: your checkout, the bit that takes customers' money. Everything below is about how much pain the business can absorb if checkout goes dark.

MTPD: the point of no return

Maximum Tolerable Period of Disruption is the longest checkout can be down before the damage becomes unacceptable. Not annoying, unacceptable. Contracts breached, regulators interested, customers gone for good. If checkout's MTPD is 24 hours, then hour 25 is where the business, not just the ops team, starts to bleed.

MTPD is a business call, not a technical one. It is the CFO and the head of sales flinching, not the engineers. Which is exactly why it belongs in a BIA and not in a config file.

RTO: the promise you have to keep

Recovery Time Objective is your target to get checkout back, at a workable level, and it must sit comfortably inside the MTPD. That gap is your margin for the day everything also decides to go wrong at once. MTPD of 24 hours, RTO of 6 hours, and you have breathing room.

RTO is the number that spends money. A four-hour RTO buys very different infrastructure than a three-day one. So setting it honestly, per activity, is how you avoid gold-plating the mailroom while under-protecting the thing that pays the bills.

RPO: how much data you can wave goodbye to

Recovery Point Objective is measured in time too, but it is about data loss, not downtime. An RPO of one hour means that after an incident you can afford to lose at most the last hour of transactions. That single number quietly dictates how often you back up or replicate.

RTO is 'how long were we down?' RPO is 'how much did we forget while we were down?' They are not the same question, and confusing them is how you end up online fast with yesterday's data.

Putting it to work (this is the company-value bit)

Set these three per activity, never once for the whole org. Your marketing site and your transaction ledger do not deserve the same numbers, and pretending they do is how budgets get wasted.

In Compliance One, the BIA register captures MTPD, RTO and RPO for every activity alongside its dependencies, owner and priority, in a table you can sort. Sort by RTO and the expensive, must-protect activities float to the top instantly. That ranked list is the input to every continuity decision you make next, from which supplier needs a backup to where the disaster-recovery budget actually goes. No workshop whiteboard required, and nothing to re-key at audit time.