Skip to content

Maximum Tolerable Downtime

What is Maximum Tolerable Downtime?

The maximum time a business process can be unavailable before the resulting harm becomes unacceptable to the organization.

Business Continuity

Terms that appear alongside maximum tolerable downtime

Each of these is named in at least one of the same controls as maximum tolerable downtime. The number is how many controls name both.

Frameworks that govern maximum tolerable downtime

NIST Cybersecurity Framework 2.0View framework →ISO 27001:2022View framework →

What the standards actually require on maximum tolerable downtime

Requirements naming maximum tolerable downtime across 3 standards, quoted from the control text.

C5 (Germany)1 control

Test restore procedures at least annually so that adherence to contractual agreements and to the defined maximum tolerable downtime and maximum permissible data loss can be assessed, and report any deviation to responsible personnel for prompt action.

C5-OPS-08 · Data Backup and Recovery - Regular Testing →
Kuwait National Cybersecurity Framework1 control

Kuwait NCF Respond and Recover functions. Incident Response and Reporting: documented Incident Response Plan + Computer Security Incident Response Team (CSIRT) + 24/7 incident hotline + Incident classification (severity + impact + urgency) + Triage + Containme...

KNCF-Respond-Incident-Response-Reporting-Recover-Business-Continuity-Cyber-Resilience-NCSC-Notification · Kuwait NCF Respond + Incident Response + Reporting + Recover + BC + Cyber Resilience + NCSC →
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems1 control

Conduct Business Impact Analysis per NIST SP 800-34 Rev 1 Section 3.2 + Appendix B (Sample BIA Template). BIA identifies and prioritises information systems and components critical to supporting the organisations mission/business processes.

NISTSP34-2 · Business Impact Analysis (BIA): Critical Resources, Recovery Priorities →

Questions people ask about maximum tolerable downtime

What is Maximum Tolerable Downtime?
The maximum time a business process can be unavailable before the resulting harm becomes unacceptable to the organization.
Why is Maximum Tolerable Downtime important for compliance?
Maximum Tolerable Downtime is a key concept in Business Continuity. Understanding maximum tolerable downtime helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Maximum Tolerable Downtime?
Maximum Tolerable Downtime appears in the requirement text of C5 (Germany), Kuwait National Cybersecurity Framework, NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Maximum Tolerable Downtime?
Explore our compliance framework pages to see how maximum tolerable downtime applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Maximum Tolerable Downtime applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.