These days, downtime is a dirty word, and staying online is the goal. However, if your company does experience downtime, setting goals for getting back online is beneficial in reducing downtime. Both essential elements of business continuity, Recovery Time Objective (RTO) and Recovery Point Objective (RPO) play a key role in the disaster recovery planning process.
RTO Defined
Recovery Time Objective (RTO) is a calculated number (specific to your business) that outlines the parameters for how quickly you need to recover your systems from downtime after an incident.
Have you identified your company’s RTO? How quickly do you need your systems up and running? By defining your RTO, you can make more informed decisions about backup and disaster recovery and implement solutions that meet your specific objective.
RTO Example
Say you need your systems working within five hours, but you calculate your average possible downtime to be eight hours, you are three hours over your RTO. As part of your Business Continuity Plan, you can see that you need to implement the proper type of preparations in order to improve.
Typically, if you need to recover quickly, you need to ensure a greater level of preparation with a higher budget. Bottom line, the faster your RTO, the more you will need to invest in recovery solutions.
RPO Defined
Recovery Point Objective (RPO) is the amount of data your business can afford to lose and still be able to function if it were to experience downtime.
When was the last time you backed up your data? If you were to lose everything right now and relied on your last backup to be back online, how much mission-critical data would you still have? RPO is that POINT in time that you need to have your latest backup. The POINT that you can recover your systems to.
RPO Example
Think of it this way. Your boss asks you to write an extensive report, critical to getting that new client, and wants it done in a crunched time period. For the purpose of this example, think to yourself that your computer is going to eventually crash, and you will ultimately lose everything up until the last time you saved your work. How much data can you lose before hindering your ability to meet the deadline? This is your RPO, and should determine how often you save (backup) your work!
Relating this back to your business, the report represents everything you and your employees have ever worked on. It is the data that is the foundation of your company. The crash of the computer represents any disaster that could cause your business downtime. The deadline represents the business continuity aspect of your business. If you lose data then your ability to get your work done is hindered. And finally, the save is your backup.
If you were to go back to your most recent backup, are you satisfied with the recovery point? If not, what specific backup frequency meets your requirements? Once you determine that, you will then have your RPO.
Keep in mind that the more recent your RPO is, the more frequently you will need to backup your systems, and the more space your data will take up. Consider moving that data offsite to ensure redundancy!
What’s the Difference?
Imagine you’re out at brunch on a Saturday morning with your mom, when she spontaneously quizzes you: what is the difference between RTO and RPO? You immediately freeze up, and slowly finish your last bite, putting your pointer finger up, to give you more time as you try to recollect this post. You wipe your face with your napkin, and exuberantly say,
“Recovery Time Objective (RTO) tells you how quickly you need to recover from downtime, where Recovery Point Objective (RPO) tells you how often you need to be backing your data up.”
She’ll be so impressed, she might even pick up the check!
Ok… maybe your mom won’t be asking you this question while you’re out at brunch, but you can easily remember that quick little phrase next time you need to explain these two concepts.
The Bottom Line
So now you have a good idea of what RTO and RPO respectively stand for, but where do you go from here? To quantitatively pursue these objectives, you will need to complete a BIA, or Business Impact Analysis.
