Risk & Recovery Metrics
RTO, RPO, MTTR, MTBF and the quantitative risk formulas, with the distinctions that decide most exam questions.
Last updated
Free, no signup · 1 page · 11 metrics + the formulas · 230 KB
Which metric is it? Scenario lookup
Questions almost never name the metric. They describe a situation and expect you to pick it.
| The statement | Metric | Why |
|---|---|---|
| "We can afford to lose at most 1 hour of data" | RPO | Data loss, measured as time. Sets your backup frequency. |
| "The service must be running again within 6 hours" | RTO | Downtime tolerance. A business decision about acceptable outage. |
| "Repairs have averaged 3 hours over the past year" | MTTR | An observed average, not a target. Historical, not aspirational. |
| "This appliance typically runs 8 months between faults" | MTBF | Between failures, so the item is repaired and put back into service. |
| "These drives are rated for 40,000 hours" | MTTF | To failure, not between. Non-repairable, you replace it. |
| "The intrusion went unnoticed for six weeks" | MTTD | Detection gap, before response even begins. |
| "A fire would destroy 40% of a $2m facility" | EF then SLE | EF = 0.4, so SLE = $2m × 0.4 = $800,000 for one event. |
| "We expect this once every four years" | ARO | ARO = 0.25. Fractions are normal for rare events. |
| "What should we budget annually for this risk?" | ALE | ALE = SLE × ARO. This is the number that justifies control spend. |
Recovery & availability
- RTORecovery Time Objectivetime
The maximum downtime the business will accept. A target you set, not a measurement.
Ordering must be back within 4 hours of an outage.
- RPORecovery Point Objectivetime
The maximum data loss the business will accept, expressed as time. Looks backwards from the incident.
Losing at most 15 minutes of transactions, so back up every 15 minutes.
- MTTRMean Time To Repair / Recovertime
How long repairs actually take, averaged. A measurement of reality, not a goal.
Over the last year, outages took 2.5 hours to fix on average.
- MTBFMean Time Between Failurestime
Average uptime between failures, for something you repair and keep using.
A server fails roughly every 9 months.
- MTTFMean Time To Failuretime
Average lifetime of something you replace rather than repair.
A drive rated for 50,000 hours before it dies.
- MTTDMean Time To Detecttime
How long a problem goes unnoticed. The gap attackers live in.
A breach found 47 days after the initial compromise.
Quantitative risk
- AVAsset Valuecurrency
What the asset is worth in total.
A warehouse of stock valued at $500,000.
- EFExposure Factor%
The share of the asset lost if the risk happens.
A flood would destroy 60% of it.
- SLESingle Loss Expectancycurrency
Cost of the event happening once. SLE = AV × EF.
$500,000 × 0.60 = $300,000.
- AROAnnualised Rate of Occurrenceper year
How often it is expected per year. Can be a fraction.
A once-in-ten-years flood is 0.1.
- ALEAnnualised Loss Expectancycurrency/yr
Expected annual cost. ALE = SLE × ARO.
$300,000 × 0.1 = $30,000 a year.
SLE = AV × EF·ALE = SLE × ARO
$500,000 asset · 60% exposure · once in ten years → SLE $300,000 · ARO 0.1 · ALE $30,000/yr
Where people lose the mark
Four distinctions that decide most questions on this topic.
- RTO vs RPO
- RTO looks forward from the incident: how long until we are running again. RPO looks backward: how much work will we have lost. A system can have a 4-hour RTO and a 5-minute RPO, and that combination is common.
- RTO vs MTTR
- RTO is a target the business sets. MTTR is a measurement of what actually happened, averaged. If your MTTR exceeds your RTO, you are failing your own objective, which is exactly what the comparison exists to reveal.
- MTBF vs MTTF
- Between failures means the item is repaired and returns to service. To failure means it is replaced. Servers and appliances get MTBF; drives, fuses and sealed components get MTTF.
- SLE vs ALE
- SLE is one occurrence. ALE is the annual figure, and the one used to justify spending. Multiplying by ARO is the step people skip: a $300,000 loss expected every ten years is a $30,000 a year problem.
Frequently asked questions
What is the difference between RTO and RPO?
RTO is the maximum time a system can be down before the impact is unacceptable, and it drives your recovery capability. RPO is the maximum amount of data you can afford to lose, expressed as time, and it drives your backup frequency. RTO looks forward from the moment of failure to the moment of restoration; RPO looks backward from the failure to your last good copy. A payment system might have a four-hour RTO and a five-minute RPO.
What is the difference between RTO and MTTR?
RTO is a target: the business decides how much downtime it will tolerate. MTTR is a measurement: the average time repairs have actually taken. One is aspirational, the other is historical. Comparing them is the point, because an MTTR longer than your RTO means your stated objective is not currently achievable, whatever the plan says.
What is the difference between MTBF and MTTF?
MTBF applies to repairable systems and measures the average uptime between failures, so the item fails, is fixed, and returns to service. MTTF applies to non-repairable items and measures how long they last before they are replaced. A server has an MTBF; the hard drive inside it has an MTTF. Exam questions usually signal which by whether the item is repaired or swapped out.
How do you calculate ALE?
Two steps. First, SLE = AV × EF: asset value multiplied by the proportion of it you would lose. Then ALE = SLE × ARO: single loss expectancy multiplied by how many times a year you expect it. For a $500,000 asset with a 60% exposure factor and a once-in-ten-years event: SLE = $300,000, ARO = 0.1, so ALE = $30,000 per year. The ALE is what you compare a control’s annual cost against.
Should a security control cost less than the ALE?
As a rule of thumb, yes: if a control costs more per year than the annualised loss it prevents, the numbers do not justify it on risk grounds alone. In practice this is a starting point rather than a decision, because it ignores regulatory penalties, reputational damage and the fact that ARO estimates for rare events are highly uncertain. Exams tend to test the clean version; real decisions rarely are.
What is MTTD and why does it matter?
Mean Time To Detect is the average time between a problem starting and anyone noticing. It sits before MTTR in the timeline, and it is often the larger number: industry breach reports routinely measure detection in weeks or months while containment takes days. Improving detection usually reduces total impact more than speeding up repair does.
About this cheat sheet
- Source
- Definitions follow NIST SP 800-34 (contingency planning) and the quantitative risk model used across CompTIA and ISC2 material.
- A caveat worth knowing
- ALE arithmetic is clean; the inputs are not. ARO for a rare event is an estimate, often a guess, so treat the output as a way to compare options rather than a prediction.
- Related
- Preventive, detective & corrective controls covers what you spend the budget on once ALE has justified it.
- Corrections
- Spotted something wrong? Tell us and we will fix it. Compiled and maintained by CyberQuizzer.