What is RTO and RPO in Disaster Recovery?

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are vital parameters in any disaster recovery plan. However, are the two terms different means towards the same end? RPO and RTO are two key metrics used by organisations when developing a disaster recovery plan that can guarantee business continuity in the face of a disruptive event. At first glance, the two terms seem to be quite similar, but they are different metrics with unique objectives in disaster recovery and continuity management. Let’s take a closer look at each metric.

Recovery Time Objective (RTO)

RTO is the time duration and a service level within which a business process must be restored after a disruptive event to avoid a break in business continuity. It dictates how quickly an organisational infrastructure needs to be back online after a disaster. RTO is sometimes used to define the maximum downtime that an organisation can tolerate and maintain business continuity. In practice, this is a target time set to have services back up and running after a disruption – say two hours.

In reality, such RTO (2 hours) is not always attainable. A disaster such as a storm could leave a business down for weeks or even months. In other cases, a small lawn care company could get by with paperwork orders for a week or more in case of an outage. In essence, RTO is different for different organisations and in different circumstances. In outsourced IT services, RTO is defined within a service level agreement. The implication is that you can choose to have a better RTO at a higher cost depending on your business requirements.

Alternatively, businesses can handle RTO internally if you have an in-house IT department. In this case, there should be a goal for addressing technical problems. Of course, the ability to meet the RTO will depend on the severity of the disaster. The RTO for a server crash is not attainable for a natural disaster such as a flood. RTO is more than just the amount of time needed to recover from a disaster, it also includes steps to mitigate and recover from different disasters.

Recovery Point Objective (RPO)

RPO describes the time interval that might pass during a disruption before the quantity of data lost exceeds the maximum allowable tolerance or threshold in the business continuity plan. For instance, after 16 hours, the effect of lost sales on a small business might become an excessive burden against costs and result in not meeting sales targets.

It is important to understand how much data is an acceptable loss in your organisation. In this regard, mirror copies and backups of data are a key part of RPO. Some organisations determine how often they need to create backups by calculating the recovery costs versus storage costs. Other businesses create a real-time clone of their data using cloud storage. In this case, a failover only takes a couple of seconds.

As with RTO and acceptable downtime, different businesses have different levels of tolerance for data loss. While a small lawn care services company can retrieve 24 hours of records without any effect on real-time operations, an online billing company can face major difficulties with just a few minutes of data loss.

RPO is often categorized by time and technology

8-24 hours

These objectives make use of external storage backups of the operations. In this case, the restoration point is the last available backup.

Up to 4 hours

These objectives call for ongoing snapshots of the operations. This allows the organisation to get data back faster with minimal disruption.

Near Zero

Such objectives require the application of enterprise cloud backup and storage solutions to replicate and mirror data. In most cases, these services offer maximum redundancy by replicating data in multiple geographic locations. The net effect is that failback and failover are seamless.

Both RPO and RTO involve time periods for the measurements. However, RTO focusses on bringing hardware and software online while RPO focuses on acceptable data loss. With so many forms of disasters to consider, it is important to define what they have in common – disruption of normal business operations.

Preparing your business for any disaster is critical to ensuring minimal downtime, continued operations and avoiding a negative impact on your reputation and revenue. This makes implementing business continuity and disaster recovery plans a crucial step for every business. That said, establishing RPO and RTO will greatly decrease the negative effects of downtime and also help you manage disasters more effectively when they happen. Partnering with a business continuity professional will help you manage RPO and RTO more effectively using the latest technologies and backed with an extended understanding of the industry. View our business continuity management and disaster recovery services for more information on how we can help.

Sami Malik

Written by Sami Malik

Marketing Campaigns Manager