RTO = time to restore service after disruption. RPO = max acceptable data loss measured in time.
Recovery Time Objective (RTO) is the maximum tolerable duration for restoring a service after a disruption. Recovery Point Objective (RPO) is the maximum tolerable amount of data loss, measured in time prior to disruption. Both are set per system in the Business Impact Analysis (BIA).
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.