Recovery Time Objective (RTO) defines the maximum acceptable downtime before business operations must be restored. It helps organizations set expectations for recovery speed and prioritize system restoration accordingly.
A (likelihood of an incident and cost) relates to risk assessment, not RTO.
B (roles and responsibilities) falls under incident response planning, not RTO.
C (state of restored systems) is covered by Recovery Point Objective (RPO), not RTO.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Security Program Management and Oversight domain.