RTO vs RPO

When talking about business continuity, and disaster recovery, the two terms RTO and RPO frequently come up.  But what are they? What do they mean?  And how do you determine what your RTO and RPO values are?  RTO and RPO sound similar, and may go hand in hand, but they are different.  In this blog we will reference backup strategies, but we will not be discussing particular solutions, companies or manufacturers, as that is outside this scope.

Recovery Time Objective

Recovery Time Objective, or RTO, simply relates to how much time will it take from the time of service disruption to restore full application and data availability.  How long can your hardware or software be down before your business is impacted is what determines your RTO.  This will vary depending on your business.  A residential painting contractor can likely continue to provide service for a week or more if his computers and data become unavailable, whereas business at a grocery store with a point of sale system that’s down is severely impacted immediately.

Recovery Point Objective

Recovery Point Objective, or RPO, relates to the company’s loss tolerance: how much data can the company tolerate losing, measured in time?  This is generally the time between the disaster event and the preceding backup.  The residential painting contractor, referenced above, has a longer RPO than the grocery store.  Your acceptable RPO time may determine the type of backup technology you use. If your RPO is between 8-24 hours, you could potentially rely on external storage backups of your production environment.  If your RPO is shorter, up to 4 hours, you’ll likely require ongoing snapshots of your production environment, as you’ll be able to get the data back and systems online quicker.  If your RPO is near zero, a continuous replication and mirroring solution will best fit your needs.

Determining RTO & RPO

So, how do you determine what your RTO and RPO is?  There are several factors to consider for each, and you will benefit greatly from working this out in advance of an outage.  When considering your RTO, you should determine how much an outage will cost your business each hour.  You then need to determine the importance and priority of each system; which systems need to come online first, and in what order? Which can safely be left for later? What exactly are the steps to recover from an outage? Finally, make a cost/benefit analysis of recovery solutions.

When considering your RPO, you must consider how much data loss your organization can sustain.  What is the cost of lost data and operations? Are there regulatory fines involved? Will your customers be subject to financial losses in an outage? And what is the cost of implementing appropriate recovery solutions?

Service Level Agreements (SLAs) may also play a part in determining, or may reflect, your RTO and RPO values. You will want to be sure your recovery solutions enable you to meet the contractual obligations you may have with your customers.

Once you have determined your RTO and RPO, in conjunction with your SLAs, you will be better able to select your backup and recovery platform and/or strategy that best suits your business. 

If you're having trouble figuring out your RTO or RPO, or if you would like to chat more about this, feel free to contact us!