Maximum Tolerable Downtime (MTD) is the longest period an organization can survive without a particular system before the disruption causes unacceptable harm — financial loss beyond recovery, permanent customer defection, regulatory violation, or organizational failure. MTD sets the outer boundary that all recovery planning must fit within.
MTD is determined through Business Impact Analysis, not technical assessment. For an e-commerce platform during peak season, MTD might be two hours. For a back-office reporting system, it might be a week. Recovery strategies must deliver restoration within the MTD.
CISSP Relevance
MTD is a foundational concept in Domain 7 (Security Operations) within business continuity and disaster recovery planning. CISSP candidates must understand the relationship between MTD, Recovery Time Objective, Recovery Point Objective, and how these metrics drive continuity planning decisions.
External reference: NIST SP 800-34 Contingency Planning Guide
Related terms: Recovery Time Objective, Business Continuity