Before defining recovery point objective (RPO) and recovery time objective (RTO), two parameters in disaster recovery planning, it is important to understand disaster recovery vs. business continuity planning (BCP), as they are related but not interchangeable.
As a company grows, BCP must be a required administrative strategy to address how a business mitigates business-interrupting risk to its personnel, assets, operations, IT, and more.
Disaster recovery plans, a subset of BCP, address protection and recovery of data and IT systems during catastrophe. Throughout BCP and disaster recovery planning, companies conduct business impact analysis to forecast the effect of disaster on a business’s overall operations. As part of the business impact analysis, organizations must set RPO and RTO parameters to pinpoint the effectiveness of disaster recovery planning solutions. Initially, these two terms seem similar. Imagine the “RP” as “rewrite parameters” and “RT” as “real-time” objectives.
Disaster Recovery Solutions
Optimal disaster recovery solutions must include RPO and RTO. Without them, selecting an optimal cloud backup system would be like picking a number from a hat — blind luck.
RPO and RTO guide a company through business continuity management planning. What is the timeframe that a business can regain viability once a disaster has occurred? What is the time threshold before a disaster seriously impedes business function? You see why calculating these objectives is critical to understanding how an organization weathers a disaster and how it recovers.
Understanding RPO
As part of BCP, the disaster recovery planning team determines the tolerance threshold for time lost during a disruption. Essentially, how long is too long for data loss during disruption? And, how much time can go by for business leaders to remain confident in data and system recovery?
To answer these questions the planning team must know the recovery point objective. If a final draft of a document was saved just prior to an outage, say 10 hours ago, and the RPO is 20 hours, then according to calculations, the BCP and disaster recovery planning team still has about 10 hours to recover systems before the company meets its RPO calculation. Twenty hours is the tolerable RPO time limit the disaster recovery planning team has set before disaster recovery reaches the next phase in recovery planning and resumption of business processes.
Setting realistic recovery point objectives requires business impact analysis; however, to know whether those objectives are realistic relates more to analysis of RTO — real-time objectives during disaster recovery.
Setting RTO Parameters
RTO parameters are set by selecting the time frame during which a business process must be restored after a disaster to mitigate unavoidable consequences. The end goal is business continuity without interruption. RTO looks at the length of time required to restore business function after a disruption.
To summarize in a simpler way, RPO looks at the impact around length of time data are lost compared with the length of time a business continues to function without serious impediment. RTO is the quantity of real time needed to ensure avoidance of serious consequences of data loss during disruption.
So, how then, are these calculations determined?
Each organization needs to understand its tolerance for data loss and downtime during a business disruption. As part of the business impact analysis, explore each of the following:
- How much is the maximum data loss that your business will tolerate?
- Is your company in an industry, perhaps healthcare or financial, where sensitive personal data are handled on a recurring basis?
- What level of your IT operations is in the cloud and how much of it is still on paper? If a fire burned a records storage facility, would all of your data be lost? Is your data stored in the cloud or on remote servers?
- What is your cost analysis for data loss and lost operations?
- Have you incorporated industry compliance standards into disaster recovery, data loss and data availability?
- What is the cost of your company’s disaster recovery plan and the recommended solutions?
Answering these questions contributes to how well a business can recover from disaster. Every company must rehearse and simulate its disaster recovery plan to pinpoint vulnerabilities and improve them. While data loss and downtime can seriously impede business functionality, there are cloud-storage and back-up solutions readily available to all companies. Knowing how to select optimal solutions comes from understanding RPO and RTO in disaster recovery planning.
Ensuring Success
There are many online resources to guide disaster recovery and business continuity planning, from the very basic, to the very granular. For best results, we always recommend consulting with your Managed IT Services provider, who should be experienced in all aspects of disaster recovery planning. In addition, there are options for disaster recovery as a service (DRaaS), which provide a range of options and subscription models.