Certified Information Security Manager (CISM) — Question 130

Recovery time objectives (RTOs) are BEST determined by:

Answer options

• A. database administrators (DBAs).
• B. business managers.
• C. executive management.
• D. business continuity officers.

Correct answer: B

Explanation

Business managers are best positioned to determine recovery time objectives (RTOs) because they understand the operational impacts of downtime on business processes. While DBAs and business continuity officers provide valuable insights, it is the business managers who align RTOs with overall business goals. Executive management may set the strategic direction, but they rely on business managers for tactical execution.