Glossary term
RTO / RPO
Also: Recovery Time Objective, Recovery Point Objective
Two core BCM metrics. RTO = maximum downtime by which a process must be back online. RPO = maximum tolerable data loss measured in time.
RTO example: online banking RTO 30 minutes means the service must be back within 30 minutes of an incident. RPO 5 minutes means at most 5 minutes of transactions can be lost.
Method: in the BIA each process gets an RTO and RPO definition that drives backup frequency, replication setup, failover architecture, location strategy. Low RTO/RPO are expensive: usually active-active setups, synchronous replication, multiple sites.
In practice
DORA and NIS2 require RTO and RPO per critical function to be explicitly documented and regularly tested. A BCM strategy without RTO/RPO values is not audit-defensible.
Related terms
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
NIS2
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
Readiness Score
A 0-100 score that quantifies how decision-ready a memo actually is. It breaks down into criteria coverage, evidence quality, risk analysis, stakeholder alignment and formal governance. A score above 70 signals audit readiness.
RFP (Request for Proposal)
A structured document that invites vendors to propose a solution against specified requirements, evaluation criteria and timeline. RFPs are the formal front-end of most enterprise buying processes; DecisionOS sits upstream of the RFP and downstream of it, not inside it.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.