I am studying to take the CISSP test and I came across a discrepancy in material on BIA. is the MTD = RTO + WRT or is the MTD > RTO + WRT?
appreciate the guidance
Equals. You must recover the systems, then you must recover the work the systems perform.
My response may be an oversimplification of the process, but yes, you add the recovery time objective to the work recovery time to get your MTD.
Just keep in mind that the MTD itself is the maximum length of time a business can survive without access to critical resources. Ideally, you do want the RTO and WRT to be less than your maximum tolerable downtime... but you have to budget for both elements in your planning.
Did a little searching and found this: https://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtdwth/
It seems to be a good graphical explanation.
Great find! Bookmarking that for later.