Maximum Tolerable Period of Disruption (MTPD) is the outer business-impact boundary: the point beyond which continued disruption creates consequences the organization considers unacceptable. This guide focuses on determining that boundary from evidence. For approval, exception handling and ongoing review, use the MTPD governance and approval guide.
Start with consequences, not recovery capability
Do not begin by asking how quickly IT can recover or by copying an existing RTO. Start with the product, service or activity and evaluate how consequences grow while it is unavailable or severely degraded. MTPD expresses tolerance of business impact; it is not a promise that recovery will occur at that time.
Map impact progression over time
Assess meaningful time bands using evidence appropriate to the service. Consider life safety, regulatory deadlines, customer harm, contractual breach, cash and financial exposure, backlog, reputation, inventory depletion and operational knock-on effects. Record when each consequence moves from manageable to unacceptable.
Use the earliest defensible intolerance threshold
If regulatory breach becomes unacceptable at 24 hours while financial loss becomes unacceptable at 72 hours, the outer boundary cannot simply be averaged to 48 hours. The earliest material intolerance threshold normally constrains the service. Document why the threshold is unacceptable and who supplied the evidence.
Adjust for peak and calendar conditions
A value derived from an ordinary Tuesday may fail at payroll, month-end, a regulatory filing deadline or seasonal peak. Determine whether tolerance changes during known high-impact periods. Where it does, plan to the more demanding boundary or explicitly document scenario-specific tolerances.
Keep RTO inside MTPD
RTO is the target for restoring an activity or resource; MTPD is the outer limit of tolerable disruption. The difference provides management margin for detection, escalation, decision-making, dependency delays and stabilization. An RTO equal to MTPD leaves no practical contingency.
Worked determination example
| Elapsed disruption | Observed consequence | Assessment |
|---|---|---|
| 4 hours | Manual workaround absorbs demand | Tolerable |
| 12 hours | Backlog and customer delay increase | Serious but manageable |
| 24 hours | Contractual service threshold at risk | Near intolerance |
| 36 hours | Mandatory obligation missed and vulnerable customers materially affected | Unacceptable |
In this example, 36 hours is a defensible candidate MTPD only if the evidence and assumptions withstand business-owner challenge. Recovery targets should be set materially earlier.
Evidence to retain
- Time-based BIA impact ratings and underlying operational data.
- Regulatory, contractual and customer deadlines.
- Volume, backlog, stock, cash or capacity assumptions.
- Peak-period variations and scenario assumptions.
- Dependency constraints that can accelerate impact.
- Business-owner rationale for the selected intolerance point.
Common errors
- Copying RTO and renaming it MTPD.
- Selecting a round number without time-based impact evidence.
- Using system availability as the only measure of business tolerance.
- Ignoring peak periods and hard external deadlines.
- Changing the MTPD upward because current recovery capability is weak.
Validate the determination
Use exercises and real incidents to compare assumed impact progression with observed behavior. If workarounds fail earlier, backlog grows faster, supplier response is slower or a deadline has changed, revisit the determination. The objective is a boundary that remains defensible under realistic disruption—not a static number preserved for reporting convenience.
Validate the MTPD as a decision limit, not a workshop estimate
An MTPD should survive challenge from operations, finance, legal, technology and executive decision makers. Validate the proposed limit against the earliest point at which consequences become unacceptable, including safety exposure, regulatory breach, contractual default, irreversible customer harm, cash or liquidity pressure, and loss of critical records. Record the evidence source and owner for every decisive assumption so later reviewers can distinguish measured limits from judgement.
Test the limit with at least two disruption patterns: a sudden total outage and a degraded-service scenario that accumulates backlog over time. Include recovery-resource contention, because several critical activities may depend on the same people, site, supplier or technology platform. Where the organization cannot demonstrate recovery before the MTPD under realistic contention, raise a treatment decision rather than silently widening the tolerance.
Govern changes and acceptance
Define triggers for reassessment such as material process change, new regulation, supplier replacement, system migration, acquisition, significant incident, exercise failure or a major change in demand. Approval should identify the accountable business owner, the challenge performed, residual uncertainty and any temporary risk acceptance. Link the MTPD to RTO, MBCO and recovery strategies so those downstream targets cannot imply a capability that exceeds the approved disruption tolerance.
A useful acceptance test is simple: an independent reviewer should be able to reproduce why the selected time is defensible, identify the consequence that makes a longer outage unacceptable, and see evidence that the recovery design is capable of operating inside that boundary. If any of those elements are missing, the MTPD remains a planning hypothesis rather than a governed continuity limit.
Use scenario ranges where certainty is false
Where consequence timing depends on demand, season, geography or customer mix, document a range and the scenario that drives the most restrictive boundary. Do not average away a severe but credible case. Record leading indicators that tell crisis leaders when the more restrictive assumption applies, and identify the decision that must be taken before the remaining tolerance is consumed.
Periodically compare approved MTPDs with exercise results, incident timelines and actual recovery performance. A repeated gap between tolerance and demonstrated capability is a governance issue requiring investment, redesign, risk acceptance or scope change. This feedback loop keeps the BIA connected to operational evidence rather than allowing targets to become static documentation.
When approving the final limit, document any dependency whose own recovery commitment is slower than the MTPD and assign a treatment owner. This makes hidden feasibility gaps visible before an incident.
Related BCM.Center resources: MTPD Governance and Approval.