The Minimum Business Continuity Objective (MBCO) is the minimum acceptable level of service or product delivery an organization must achieve to meet its business objectives during a disruption. The Recovery Time Objective (RTO) is the target timeframe within which this level must be reached. Therefore, the MBCO is the performance target that is attained at the point in time defined by the RTO. An organization resumes its critical activities within the RTO, and upon resumption, they should be operating at or above the specified MBCO.

A. MBCO is a service level objective (a 'how much'), whereas RTO is a time-based objective (a 'how soon'); they are distinct, though related, metrics.

C. MBCO is determined during the Business Impact Analysis (BIA) to understand the impacts of a disruption, not during a risk assessment, which identifies threats and vulnerabilities.

D. The mobilization of response teams is a tactical action triggered early in an incident response, not the strategic recovery level defined by the MBCO.

1. Business Continuity Institute (BCI), Good Practice Guidelines (GPG), 2018 Edition.

Section 5.4.3, Determining priorities for recovery: "The BIA determines the recovery time objective (RTO) for the resumption of the prioritized activities that deliver the key products and services to a specified minimum business continuity objective (MBCO)." This passage explicitly states that the RTO is the time set to achieve the MBCO.

Glossary of Terms: Defines MBCO as the "minimum level of services and/or products" and RTO as the "period of time following an incident within which a product or service must be resumed."

2. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 8.2.2, Business impact analysis: The standard requires the organization to determine "the time frame for recovering prioritized activities at a specified minimum acceptable capacity." This directly aligns the concept of a time frame (RTO) with a minimum capacity (MBCO).