A recovery time objective, or RTO, is the target maximum time allowed to restore a service after an outage, cyberattack, or other disruption. It answers a practical question: how long can this system stay unavailable before the business suffers unacceptable damage?
RTO matters because not every service needs the same speed of recovery. A payment platform may need minutes, while an internal archive can tolerate hours or days. Security teams use RTO to design backups, failover, manual workarounds, and incident response playbooks around real business priorities. In attacks such as ransomware or destructive intrusions, an aggressive RTO can expose weak points: backups may exist, but access controls, identity systems, or network dependencies can slow restoration. Measuring and testing RTO helps defenders see whether recovery plans actually work under pressure.