RTO and RPO: meaning and difference
The RTO (Recovery Time Objective) is the maximum time within which a service must be available again after a disruption. The RPO (Recovery Point Objective) is the maximum amount of data you can afford to lose, expressed as the time elapsed since the last usable copy.
In short
Picture a timeline with the moment of the failure in the middle. The RPO looks back: how far into the past can I go back? If the last backup is from last night, everything entered today is lost. The RTO looks forward: how long before the service works again? Both are set as objectives, process by process, starting from the Business Impact Analysis.
How it works
- The RPO depends above all on how often you copy the data. A nightly backup gives an RPO of about 24 hours; hourly copies or continuous replication bring it down to an hour or a few minutes.
- The RTO depends on how you restore: how long it takes to have hardware available, restore the data, check that the applications work and reopen access. A restore from tape, a standby virtual machine ready to go or an active secondary site give very different times.
- The RTO must stay below the maximum tolerable period of disruption set by the BIA, with a margin.
More ambitious objectives cost more. The point is to choose knowingly: not every system deserves a five-minute RPO.
Why it matters
Many companies discover their real RTO during an incident, and it is usually much longer than they thought: the backup was there, but restoring two terabytes takes two days. With ransomware there is an extra problem: if the attackers had been in the network for weeks, the last "clean" copy may be older than the most recent copy. That is why RTO and RPO must be verified with regular restore tests, not just stated in a business continuity plan.
Example
For a professional firm's management software, the BIA establishes that a full day of downtime is the maximum tolerable and that losing more than half a day of entries would be serious. This gives an RTO of 8 hours and an RPO of 4 hours. The nightly backup is not enough: copies every four hours are added. A restore test shows that getting the server back up takes 14 hours: a standby virtual machine is prepared, and the next test comes down to 6.
Related terms
Where you find it in Dottor Box
Business continuity guides you with three questionnaires: the Business Impact Analysis, which asks which activities are critical and how much disruption they can tolerate, the continuity plan, and the backup and restore check, to find out whether the copies have really been tested.
Business continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more ProveSpecialist consulting
A Dottor Marc specialist by appointment, booked directly from the dashboard.
Learn more