Explanation of Recovery Time Objective vs. Recovery Point Objective

RTO and RPO refer to different objectives in a business continuity plan – the book you open when something has gone wrong and the very existence of your organization is in question. But what are they, exactly? And how are they different?

RTO stands for recovery time objective. It is the time that elapses between the occurrence of a serious failure and the resumption of your business operations. It’s called a target because it’s a target: it waits for the RTO to bring it back up and running.

By comparison, RPO stands for Recovery Point Objective. This is the maximum amount of time covered by your backups. If your RTO is one month, you can restore your data from any point between your most recent backup and one month ago.

This flexibility is important, as you may not be sure how far back you have to find uncorrupted data. If you only find out you’ve been hacked three months after it happened, you’d better hope your RPO is further behind than that. If you’re recovering from a natural disaster, at the very least, you usually know about it right away.

So, at some levels, the recovery time objective vs. recovery point objective debate is more about how far behind your backups are (RPO) versus how long it takes you to restore everything (RTO). ).

How do you assess the recovery time needed for your business? This should be the RTO in your recovery plan. The most important factor is probably how much downtime costs your business. The service level agreements (SLAs) in place with your customers could be a big part of that calculation, as could the loss of reputation or customer dissatisfaction that your downtime would cause. In the end, all this can be measured in dollars.

A small local business could endure downtime longer and with fewer consequences than a company like Google. The largest search engine in the world would lose exponentially more the longer its downtime persists than the little shop around the corner.

In short, it all depends on your business and how much downtime you’re willing to contemplate.

So how do you determine how much data loss you can afford in a disaster situation? Well, there will be a number of factors, and you will have to weigh them in terms of your own organization.

Consider how much it would cost to implement a recovery solution that offers full protection, offers enough protection to make you feel reasonably secure, and barely covers the bare minimum.

Now, compare the cost of each of those plans to the cost of re-entering all your lost data, the cost of recovering or rebuilding any data that was actually lost, the maximum amount of such loss your company can sustain without being dissolved. , and how much new data will be lost (or how much you won’t be able to capture) while your operations are paused or stopped.

What should you include in your plans? Maximizing one goal does not always mean compromising the other. Some business continuity plans do not consider recovery time objective and recovery point objective to be in conflict at all.

A good backup solution is at the heart of your disaster recovery plan, but other aspects may be just as or even more important, depending on the type of business and recovery strategy.

Backups make copies (ideally, well-protected off-site copies) of all your critical data. Disaster recovery uses those backups to rebuild your operations if something really terrible happens.

How do you create a sustainable plan to avoid downtime? This is one place where you may need to balance the recovery time objective versus recovery point objective values ​​against each other. However, a good plan will make enough space for both.

There are a number of best practices you can execute to ensure the best possible outcome for your business:

Plan ahead to ensure you know how you will rebuild after all types and scales of disasters. Make sure your backups, hardware, security, and even personnel procedures are up to date and fit for purpose. Keep your workforce up to date with your business continuity plans. Back up more than just your data – install a separate backup power system if you have the resources. Test your recovery infrastructure regularly to make sure it’s really protecting you.

Remember, recovery time objective versus recovery point objective does not describe a true dichotomy. You can easily have both on the same plan. In fact, you really should. And upgrading one shouldn’t mean downgrading the other.

Consider whether it would be better to look at a business continuity, disaster recovery, or data backup provider. A company like Liquid Web may be a better and more cost-effective solution than your in-house team.