How to answer 'What are your RTO and RPO for disaster recovery?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Give concrete time targets (e.g., RTO < 4 hours, RPO < 1 hour), state how often the disaster recovery plan is tested, and cite the specific section of your BCP policy. Never give 'zero downtime' or 'near-instant' — enterprise reviewers reject unrealistic SLA claims as non-credible.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · BCM-01
Our target RTO is 4 hours and target RPO is 1 hour for primary production data stores; DR procedures are tested annually and documented in our Business Continuity Plan (SOC 2, A1.3).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default