Every disaster recovery conversation eventually comes down to two numbers. Without them, nobody can say whether a backup strategy is good enough or too expensive.
Recovery point objective (RPO)
RPO is the maximum amount of data, measured in time, that you can afford to lose. If your RPO is four hours, you must always have a copy no older than four hours. A nightly backup gives an RPO of up to 24 hours: a failure late in the day loses most of that day's work.
Recovery time objective (RTO)
RTO is how long a service can be unavailable before the damage becomes unacceptable. It covers everything: noticing the problem, deciding to fail over, restoring data, testing, and redirecting users.
Why they drive cost
Shorter RPO and RTO cost more.
- An RPO of a day with an RTO of a few days can be met with good backups and a documented rebuild process.
- An RPO of minutes needs continuous replication.
- An RTO of minutes needs standby infrastructure that is already running and ready to take over.
The right answer is different for each system. Your payment platform and your internal wiki do not need the same targets.
How to set them
- List your systems and what depends on each.
- For each, ask the business, not just IT: what does an hour of downtime cost? What does losing an hour of data cost? Think about revenue, contracts, regulators and reputation.
- Group systems into tiers, for example critical, important and deferrable.
- Choose an approach for each tier that meets its targets.
- Test. An untested RTO is a guess.
Measure the real numbers
Run a recovery exercise and time it. Many organisations discover that their "four-hour" recovery takes two days because of a missing password, an undocumented dependency or a backup that restores far more slowly than expected.
How IDX helps
IDX Disaster Recovery provides replicated standby infrastructure with tested failover, for systems whose RTO is measured in minutes or hours. For less critical systems, our Data Backup service and Box Storage provide versioned backups. Our team can help you set realistic targets for each tier and design to meet them.
IDX on digital infrastructure
Back to blog →