Defining Maximum Tolerable Period of Disruption

Disaster Types

Order DRP BCP Template  DRP BCP Sample

Defining Maximum Tolerable Period of Disruption (MTPOD) became an issue with the introduction of British Standard 25999-2. When applied correctly, MTPOD improves management's understanding of the disaster recovery business continuity program and clarifies the enterprise's recovery priorities.

Risk AssessmentBS 25999-2, Section 4 says that the goal of a business impact analysis is to "determine the impact of any disruption of the activities that support the organization's key products and services. " A key aspect of determining the impact of a disruption is identifying what BS 25999 calls the "Maximum Tolerable Period of Disruption," or MTPOD. BS 25999 defines MTPOD as the "duration after which an organization's viability will be irrevocably threatened if product and service delivery cannot be resumed. " 

MTPOD is the maximum amount of time that an enterprise's key products or services can be unavailable or undeliverable before its stakeholders see unacceptable consequences.

Disaster Recovery Time Line

The application of this concept often means rethinking how a business impact analysis  is approached. While many DRP / BCP professionals start a business impact analysis - by gathering data from individual departments, MTPOD forces DRP / BCP professionals to first look at products and services. Disaster Recovery and Business continuity professionals should understand downtime tolerance, taking into account:

  • Customer expectations
  • Regulatory requirements
  • Reputational issues
  • Financial and operational impairment
  • Strategic consequences.

Based on management input, disaster recovery / business continuity professionals can propose preliminary Maximum Tolerable Periods of Disruption for key products or services within the scope of the disaster recovery and business continuity program.

Once MTPOD is established for key products and services, the traditional business impact analysis  or service. From there, the business impact analysis  can either validate or disagree with preliminary MTPOD conclusions. In addition, the business impact analysis  does identify the department, function and process details that are needed to achieve the MTPOD.

Perhaps most importantly, the disaster recovery / business continuity professional must understand the amount of time required to perform the process or activity in order to deliver the product or service to its key stakeholders (internal or external). This is cycle time. For example, in a manufacturing company, cycle time would be how long it takes to obtain the necessary stock, manufacture the product, and deliver it to the customer.

With an understanding of MTPOD and cycle time, the business continuity professional can identify what is commonly accepted as the core output of the business impact analysis   - the recovery time objective, or RTO. RTO is the point in time following a disruption when operations must resume (at a minimum level) in order to meet downtime tolerances.

Order DRP BCP Template  DRP BCP Sample