What Are RTO and RPO?

RTO (recovery time objective) is the maximum time a system can be down before the impact becomes unacceptable. RPO (recovery point objective) is the maximum amount of data, measured in time, you can afford to lose. Together they decide how your backups and disaster recovery must be built.

RTO in plain terms

"If our accounting system goes down, we need it back within four hours." That is a four-hour RTO. A short RTO requires fast recovery methods: replicated servers, cloud failover, standby hardware. A long RTO can live with restoring from backup to whatever is available.

RPO in plain terms

"We can afford to lose at most one hour of order entries." That is a one-hour RPO, which means backups or replication must run at least hourly. A 24-hour RPO means nightly backups are fine.

Set them per system, not per company

Email and identity might need an RTO of an hour. The archive file server might tolerate two days. Setting everything to the strictest target is expensive; setting everything to the loosest target is dangerous. A good disaster recovery plan lists each critical system with its own RTO and RPO.

How they drive design

• Short RPO: frequent snapshots, continuous replication, cloud sync.
• Short RTO: virtualization, cloud failover, pre-built recovery environments, documented runbooks.
• Long RTO/RPO: standard daily backups with off-site copies.

Where people get caught

The stated RPO is one hour but the backup runs nightly. The stated RTO is four hours but the last restore test took two days. Objectives only mean something if they are tested; see how often should you test backups. The business side of the same conversation is the business continuity plan.

For Mentis Group Fully Managed IT clients, DR plans are reviewed during strategic sessions to confirm recovery time and recovery point objectives still match business requirements as the company changes.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.