RTO and RPO: definition, difference and calculation
What do RTO and RPO mean?
RTO (recovery time objective) and RPO (recovery point objective) are the two most important target metrics of business continuity management. The RTO is the maximum accepted time until recovery of a process after a disruption. It looks forward from the moment of disruption. The RPO is the maximum tolerable data loss, expressed as a period before the disruption. It looks back. Both values are set per process and are the yardstick against which backup, recovery and contingency concepts are measured. Internationally they are defined, among others, in NIST SP 800-34 and within the framework of ISO 22301.
What is the RTO?
The recovery time objective answers the question: how fast must this process run again? An RTO of four hours means that the process should be available again at the latest four hours after the outage. The RTO drives the recovery infrastructure: the shorter it is, the more redundancy, automation and emergency capacity are needed. The RTO must always be below the maximum tolerable period of disruption (MTPD).
What is the RPO?
The recovery point objective answers the question: how much data may be lost? An RPO of 15 minutes means that in a real incident at most the data of the last 15 minutes may be lost. The RPO drives the backup and replication frequency: an RPO of 24 hours can be met with a daily backup, an RPO of minutes requires near-continuous replication.
What is the difference between RTO and RPO?
| Dimension | RTO | RPO |
|---|---|---|
| Question | How fast must the process be back? | How much data may be lost? |
| Direction | forward (from the start of the disruption) | backward (before the start of the disruption) |
| Measured in | time until recovery | time of data loss |
| Driver of implementation | recovery infrastructure, emergency processes | backup and replication frequency |
| Example | shop system back online within 4 hours | at most 15 minutes of order data may be lost |
A simple mnemonic: the RPO lies to the left of the moment of disruption (past, data loss), the RTO lies to the right of it (future, recovery time).
How are RTO and RPO determined?
Both values are derived in the business impact analysis, not estimated. The basis is the criticality of the process, the development of damage over time and legal or contractual requirements. The more critical the process, the shorter RTO and RPO and the higher the effort to meet them. The target times must therefore be ambitious enough and at the same time economically justifiable.
Further metrics in the vicinity
- MTPD/MAO: maximum tolerable period of disruption. That is the upper limit below which the RTO must lie.
- MBCO: minimum business continuity objective, that is the minimum level of service in emergency operation.
- WRT: work recovery time, that is the time needed after technical recovery to resume normal operation.
Checking target times in an exercise
RTO and RPO on paper are worthless if the team does not meet them in a real incident. That is exactly what a tabletop exercise checks. The team plays through an outage and sees whether recovery and communication work within the target times or where they get stuck.
Frequently asked questions
What is the difference between RTO and RPO?
The RTO (recovery time objective) is the target time until a process runs again after a disruption. It looks forward. The RPO (recovery point objective) is the maximum tolerable data loss, measured as the period before the disruption. It looks back.
How are RTO and RPO determined?
Both values are derived per process in the business impact analysis (BIA): from the criticality of the process and the tolerable damage. The RTO must always be shorter than the maximum tolerable period of disruption (MTPD).
What does an RPO of zero mean?
An RPO of zero means that no data loss is tolerated. Technically that is only achievable with synchronous replication and is correspondingly expensive. Most processes get by with an RPO of minutes to hours.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.