RPO and RTO

What it means

RPO and RTO are the two basic recovery targets after an IT outage. The recovery point objective (RPO) defines the maximum amount of data a company can afford to lose, that is how old the last usable state may be. The recovery time objective (RTO) defines how quickly the system must be running again.

If the accounting system has an RPO of four hours, backups must run at least every four hours so that an outage loses at most that much work. If its RTO is one day, the company must have a technical solution and procedure ready to restore the system within 24 hours.

Both targets are set separately for each important system, based on what downtime or data loss costs the company. They form part of the business continuity plan and the recovery plan and determine which technologies and what budget for backup and recovery are appropriate.

How it works in practice

With clients we start with a simple question for each system: what would happen if it were unavailable for an hour, a day, a week, and how much work would have to be redone if the last day’s data were lost. Sensible RPO and RTO values follow from the answers.

For an online shop or point-of-sale system the targets are usually strict, because every hour of downtime means lost sales. For an archive of old documents they can be relaxed. Differentiating avoids spending heavily where it is not needed while protecting what is critical.

The targets must be verified by a test restore. Only when a system has actually been restored from backup and the time measured does the company know whether its RTO is realistic. Testing is also good practice for incident response.

What to watch out for

A common misconception is that a cloud service automatically delivers any RPO and RTO. The provider guarantees service availability, but after accidental deletion or an attack on the company’s account it may be unable to restore the pre-incident state. Read the contract terms.

In a ransomware attack, it often turns out that backups were connected to the same network and were encrypted too. To meet the RPO, it is therefore essential to have at least one copy that is separated or immutable, out of the attacker’s reach.