What is Maximum Allowable Downtime (MAD)?

Understanding Maximum Allowable Downtime (MAD)

Maximum Allowable Downtime (MAD), also known as Maximum Tolerable Downtime (MTD), is the longest period a critical business function can be unavailable before the organization suffers unacceptable or irreparable harm. It defines the outer time limit for recovery and is a foundational metric in business continuity and disaster recovery planning.

MAD is determined through a Business Impact Analysis (BIA), where stakeholders assess the operational, financial, legal, and reputational consequences of an outage at increasing durations. The resulting MAD sets the ceiling that all recovery objectives must fit within: the Recovery Time Objective (RTO), the targeted time to restore service, must be shorter than the MAD, and the time to procure and configure recovery resources (sometimes called Work Recovery Time) plus the RTO together cannot exceed it. These concepts are codified in standards such as ISO 22301 and NIST SP 800-34.

MAD matters because it converts the abstract goal of resilience into a concrete design constraint that drives investment. It tells leadership how much downtime is survivable and therefore how much to spend on redundancy, failover, and backups. A function with a very short MAD justifies hot standby sites and automated failover; one with a long MAD may rely on cheaper, slower recovery. Without a defined MAD, organizations either overspend on functions that can tolerate downtime or, worse, underprepare for functions whose failure could be existential, directly threatening availability and even survival.

For example, an online stock-trading platform's BIA finds that its trade-execution system has a MAD of 15 minutes, beyond which financial losses and regulatory penalties become catastrophic. To stay within that window, the firm sets an RTO of a few minutes and invests in highly resilient, geographically redundant infrastructure with automated failover. By contrast, an internal HR reporting tool might have a MAD of several days, justifying a far simpler, lower-cost recovery approach. Related terms: BIA, RTO, RPO, Business continuity, Disaster recovery, SLA.