RTO vs. RPO

RTO and RPO (recovery time objective and recovery point objective) are two key metrics that organizations must consider in order to develop an appropriate disaster recovery plan that can maintain business continuity after an unexpected event.

Although only one letter separates RTO from RPO, it’s important not to confuse or conflate these two metrics. Both help to determine maximum tolerable hours for data recovery, how often data backups should occur and what your recovery process should be. Both need to be considered when creating a disaster recovery plan.

To understand the differences between RTO and RPO, let’s first look at the definition of each term, and which types of information it measures.

RTO

RTO stands for Recovery Time Objective. It’s a metric that helps to calculate how quickly you need to recover your IT infrastructure and services following a disaster in order to maintain business continuity.

RTO is measured in terms of how long your business can survive following a disaster before operations are restored to normal. If your RTO is twenty-four hours, it means you’ve determined that the business can maintain operations for that amount of time without having its normal data and infrastructure available. If data and infrastructure are not recovered within twenty-four hours, the business could suffer irreparable harm.

RPO

RPO, or Recovery Point Objective, is a measurement of the maximum tolerable amount of data to lose. It also helps to measure how much time can occur between your last data backup and a disaster without causing serious damage to your business. RPO is useful for determining how often to perform data backups.

RPO is significant because in most cases, you will likely lose some data when a disaster occurs. Even data that is backed up in real-time has a risk of some data loss. Most businesses back up data at fixed intervals of time -- once every hour, once every day or perhaps as infrequently as once every week. The RPO measures how much data you can afford to lose as the result of a disaster.

For example, imagine that you back up your data once every day at midnight and a disaster occurs at eight in the morning. In that case, you would lose eight hours’ worth of data. If your RPO is twenty-four hours or longer, you’re in good shape. But if your RPO is, say, four hours, you're not.

Differences Between Recovery Objectives

RTO and RPO are both business metrics that can help you calculate how often to perform data backups. However, there are some key differences:

Assessment basis. RTO reflects your overall business needs. It’s a measure of how long your business can survive with IT infrastructure and services disrupted. In contrast, RPO is just about data. It determines how often to back up data and does not reflect other IT needs.

Cost relevance. The costs associated with maintaining a demanding RTO may be greater than those of a granular RPO. That’s because RTO involves your entire business infrastructure, not just data.

Automation. Meeting your RPO goals simply requires you to perform data backups at the right interval. Data backups can easily be automated, and an automatic RPO strategy is therefore easy to implement. RTO, on the other hand, is more complicated because it involves restoring all IT operations. It is virtually impossible to achieve RTO goals in a completely automated way (although you should automate as much of your recovery process as possible).

Ease of calculation. In some ways, RPO is easier to implement because data usage is relatively consistent and there are fewer variables. Because restore times involve your entire operation, not just data, it is more complicated. Restore times can change based on factors such as the time of day or the day of the week at which a disaster occurs. The RTO must be aligned with what is possible by the IT organization. If the minimum restore time possible is 2 hours, then an RTO of 1 hour will never be met. It administrators must have a good understanding of the speeds with which different types of restores can take place. Only then can an RTO be properly negotiated and met based on the needs of the business owners.

RTO, RPO and Disaster Recovery Planning

To build a disaster recovery plan that guarantees the survival of your business after a disaster and is also cost-effective, you should consider both RTO and RPO. You need to ensure that you can achieve both RTO and RPO goals in order to recover effectively from a disaster.

At the same time, to save money you should avoid excessive investment in RTO and RPO assurance. For example, if your business RTO is 4 hours and your IT infrastructure is capable of a 2 hour restore time, it would be an unnecessary expenditure to make a big investment in hardware/software to lower the minimum restore time to 1 hour since there is no current business need.

WEBINAR RECORDING: Disaster Recovery and Cloud Management in Public Cloud Storage