Cyber Recovery Time

What is the Cyber Recovery Time (CRT)?

Cyber Recovery Time defines the time it takes for a company to be operational again at a defined level after a cyber incident. It is the last part of the Mean-time-to-recover (MTTR).

Cyber Recovery Time (CRT) not only includes the simple RTO (Recovery Time Object), but also the validation of backup data and possibly the cleaning of data from any malicious software.

The defined level is often also referred to as the Minimal-Valuable-Company and defines the systems that are absolutely necessary to be operational. This is where the interface to Business Continuity Management (BCM) comes in, which defines these systems with the Business Impact Analysis (BIA).

In 2025, the average Cyber Recovery Time in the DACH region was 8.6 months.