CAIQ v4
Control BCM-01
Extractive Review Standard
How to answer 'What are your RTO and RPO for disaster recovery?' on a CAIQ
Reviewer Guidance & Pitfalls
Give concrete time targets (e.g., RTO < 4 hours, RPO < 1 hour), state how often the disaster recovery plan is tested, and cite the specific section of your BCP policy. Never give 'zero downtime' or 'near-instant' — enterprise reviewers reject unrealistic SLA claims as non-credible.
Example Answer Passing Enterprise Audit
Compliant Response Template
Our target RTO is 4 hours and target RPO is 1 hour for primary production data stores; DR procedures are tested annually and documented in our Business Continuity Plan (SOC 2, A1.3).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.