How do you use RTO, MAO, and RPO in planning information risk management activities? This type of question contains radio buttons and checkboxes for selection of options. Use Tab for navigation and Enter or space to select the option. A option A Return to operations $($RTO$)$ is the desired time to get all business processes back into operation, whether on backup or workaround systems or on production systems. The recovery point objective $($RPO$)$ sets priorities for which systems to bring up first, or for which business processes to get back into operation before others $($of lower priority$).$ B option B The recovery point objective $($RPO$)$ establishes the maximum amount of data that is lost due to a risk event. This could be in numbers of transactions or in units of time, and it indicates the amount of rework of information that is acceptable to get systems back into normal operation. C option C The recovery time objective $($RTO$)$ must be less than or equal to the maximum acceptable outage. The MAO sets a maximum downtime $($outage time$)$ before mission impact becomes unacceptable; the RTO can be used to emphasize faster than MAO restoration. D option D The maximum acceptable outage $($MAO$)$ relates to the mission or business objectives; if multiple systems support those objectives, then all of their recovery time objectives $($RTOs$)$ must be less than or equal to the MAO.