RTO & RPO are vital parameters for making a BC/DR plan, as they allow us to determine the maximum amount of time that is able to pass before a situation becomes critical and is no longer considered to be contained. These help to guide business when making decisions that will formulate their plan B backup.
For example, if a business can only be down for 8 hours before reaching their maximum RTO & RPO, it is essential that processes are put in place that allow them to continue operations within that 8-hour time frame. If the current contingency plan exceeds this, alternative BC/DR solutions must be found.
The differences between RTO & RPO
There is a common Mnemonic tool that helps to differentiate between these 2 terms.
- RTO: Recovery Time Objective / RT = real time
- RPO: Recovery Point Objective / RP = re-write parameters
RTORecovery Time Objective outlines the maximum amount of time that can pass before a business begins to face serious consequences as a result of a disaster. It measures how quickly workloads can be restored from a backup. In cases where data is saved and backed up instantly, the RTO can be as small as a few seconds. RTO’s can also be determined by points in time, for example end of working hours, or end of week. This can also vary according to seasonal changes. (down time in a peak month will have a smaller RTO as the losses are greater). By prioirtising your business processes, you can also prioritise resources accordingly.
RPORecovery Point Objective is the maximum amount of data that can be lost during downtime before putting the business into a critical state. Each backup taken of your data is a recovery point. If you back up your data on an hourly basis, then the RPO is 60 minutes, meaning that in the worst-case scenario, rolling back to the last backup represents 60 minutes of lost data. This is assuming that they are stored instantaneously. If back ups take 15 minutes, then this is added to the RPO making the full time 1h 15.
It is important to note also, that there are differences between the occurrence of a disaster and the discovery of a disaster. Most BC/DR plans will accommodate to the latter, as nothing can be done in this time frame.
How RPO & RTO help BC/DR planning
Let’s use the above example. Assume the RPO is 1hr 15mins, and the RTO is 24 hours. That gives your business a window of 22hrs 45 mins in which to re-establish data and continue with business as usual. Considering that most businesses operate on 8-hour days, this is plenty of time to recover data from the most recent backup.
How to calculate RTO & RTOThe most effective way to calculate your RTO & RPO is to conduct a business impact analysis. This will not only look at timings and loss of data, but also revenue, property, equipment and personnel. By predicting the consequences in the event of a disaster, business can not only take steps to prevent and protect against disasters, but also ensure continuity of customer experience, staff safety and comfort with minimal loss.
What can affect RTO & RPO?While there are many factors that will affect the overall BC/ DR plan such as the size of company, personnel, location and equipment, when dealing strictly with data, this is reliant upon how and where the data is stored, backed up and recovered. In some extreme cases, data may need to be physically couriered from the back up location, however it is far more likely these days that your backups will be cloud managed, if this is the case, the data will need to be downloaded to a secure device before it can be restored. Even when the backups are on site, there can be delays when uploading data to the production environment.
Well there you have it, a bite size guide to RTO & RPO in a nutshell. To find out more about planning for BC/DR, check out our ultimate guide here, or contact us to find out more about the BC/DR solutions we provide, the value of having a BC/DR plan and advice on business impact analysis.
TLDR (Too Long Didn't Read)
- Recovery Point Objective (RPO) refers to the point in time in the past to which you will recover.
- Recovery Time Objective (RTO) refers to the point in time in the future at which you will be up and running again.
- To determine RTO & RPO, conduct a business impact analysis. This will allow you to priorities processes and choose the best BC/DR solutions.
- Consider where and how your data is stored to minimise RPO needed and maximise RTO.