What is a reasonable recovery time objective?

Companies must consider the implications of downtime and focus on maintaining continuity of business operations. To do this, a proper business continuity plan needs to be implemented to allow them to minimize downtime or avoid it completely. In this way, companies can ensure that their IT infrastructure is resilient.

When discussing business downtime, you’ll often hear about recovery time objectives (RTO) and recovery point objectives (RPO). It is critical for every business to have a complete understanding of RTO and RPO to ensure a rapid recovery from a disaster.

We’re going to discuss how to measure RTO and RPO, the role of these metrics in a backup business continuity plan, and how to define and achieve your business’ RTO and RPO goals.

What is recovery time objective (RTO)? 

Recovery time objective (RTO) is a key metric that helps you to calculate how quickly a system or application needs to be recovered after downtime so there is no significant impact on the business operations. In short, RTO is the measure of how much downtime you can tolerate.

In case of unexpected outages, one or two systems might fail and you are going to face downtime until this is resolved. This puts you in a situation where you need to determine the time within which you need to restore the system so that your business operations do not interrupt. This is where RTO comes in. 

Defining RTO involves understanding the tolerance downtime of each system and for each of your application, you will probably have different RTOs. Once you define the RTO metric, you are all set to plan for recovery that includes recovery strategy and technology that you need to have in place for a successful and rapid restore from downtime.

What is recovery point objective (RPO)? 

Recovery point objective (RPO) is a metric you set for the amount of data loss your business can endure and continue to function without any effect on the business operations.  

To determine the RPO, you need to assess the criticality of the data to know whether you need to recover all of the data or some of it and there may even be data that is relatively less significant and doesn’t need to be restored. Based on this, you will be able to define RPO for your system: the higher the criticality of data, the lesser should be the value of RPO.

Determining RPO is an essential part of a backup plan as it helps you to set how frequently you want to backup your data based on its criticality.

Differences between RTO and RPO 

RTO and RPO are important elements associated with backup and disaster recovery plans. Both RTO and RPO are defined as well as measured in units of time. Although RTO and RPO may sound alike, there are some major differences: 

Recovery time objective (RTO)

Recovery point objective (RPO)

Related to the tolerable downtime until recovery

Related to tolerable data loss

Related to the time taken to restore

Related to the backup frequency 

Related to restoring to normal with the latest data

Related to how latest the recovered data will be 

Focused on the recovery technologies required to meet goals, including restoring the entire system or only the application or more granular level

Focused on automating the backups for your system at proper intervals

Using RTO and RPO to minimize business downtime 

IT downtime occurs due to multiple reasons like system crashes, network or application failures, data loss due to a ransomware attack, or site disasters due to natural calamities. If any of the aforementioned unforeseen happens, it can halt your business operations and can cost you more.

Applications are crucial and need to be always available. A failure of a critical application of your business leads to an interruption in the application service and also results in data loss. This has a direct impact on your business operations both in the short- and long-term and affects your productivity, revenue, and brand. In some extreme cases, it can even cause your company to go out of business.

An application's tolerance downtime can vary depending on the business, but the critical factor here is to reduce downtime by quickly restoring the availability of the application. 

To get your systems up and running in a timely manner, every business needs to have a solid data protection strategy, i.e. a backup and disaster recovery plan in place. When selecting a backup and disaster recovery plan for your business, you should look for a solution that offers a shorter RTO and RPO. This lets you achieve minimal downtime and ensure business continuity by restoring the system when required. 

Risks of ignoring RTO and RPO metrics 

RTO and RPO metrics will help you minimize the risks associated with downtime if you assess and define them correctly. These metrics should be aligned with your business recovery objectives and service-level agreement (SLA) management.

If you don’t define RTO and RPO properly, it could lead to any level of risk from less to severe. Additionally, you will not be able to restore the data from the required point in time, which can result in the loss of data and can interrupt business operations. On top of that, you won’t be able to bring your system up within the required time. If the critical system is unavailable when required, this can halt the business operations.

In both cases mentioned above, interruption in business operations can lead to loss of productivity. In the worst cases, this will lead to loss of revenue and can cause serious implications like loss of business reputation. 

How to achieve RTO and RPO with a backup and disaster recovery plan

Any backup and disaster recovery solutions you are looking at will specify their assured RPO and RTO assured in their SLA. Always make sure that the backup and disaster recovery solution you choose ensures your business recovery objective goals: RTO and RPO.

Backup and disaster recovery solutions offer multiple functionalities to achieve your business RTO and RPO goals. We’ll look at some of the important functionalities that you need to look for in a backup and disaster recovery solution that will help your business to achieve near-zero RTO and RPO. 

Flexible scheduling policies

Today’s backup and disaster recovery solutions offer flexible scheduling policies to define RPO for your applications. The scheduling policies allow you to run an automated backup at regular intervals like every few minutes, every few hours, or once a day. This makes the implementation of RPO much easier. 

Continuous data protection (CDP) ensures that every time a change is made on your system/application, it is backed up or replicated instantly. This solves the problem where businesses risk losing data generated between two scheduled backups and allows you to achieve zero RPO. However, when you enable CDP for critical workloads, there might be performance or stability issues as it utilizes more resources. For these reasons, CDP is widely used for file-level backups.

Near continuous data protection can be set to near zero and run at regular intervals. This is close to achieving the effect of CDP and can be enabled for performing image-level backup/replication that uses snapshot-based technology or other. Most backup and disaster recovery solutions in the market allow you to achieve near-zero RPO of fewer than 15 minutes for your critical system. 

Instant recovery capabilities

Your business requires an option to meet your near-zero RTO goals that can be achieved through instant recovery.

One of the instant recovery capabilities that every business needs as a part of their backup and disaster recovery plan is the ability to instantly boot the backed-up machine directly from the backup storage as a ready-state virtual machine to continue their business operations. 

You can immediately start a machine in the virtual environment from the latest backup or from any point in time using the backup data that is still in the encrypted and compressed format on your backup storage. You can now have your critical system up and running within a few minutes and ensure business continuity while meeting near-zero RTO. 

With this, you are able to minimize downtime and all your Tier 1 mission-critical systems continue to operate with no impact on the business. Later you can migrate the instantly booted virtual machine to production for permanent recovery. 

Granular recovery 

The role of granular recovery in a backup and disaster recovery plan plays a significant role. It provides you the ability to restore only the data you need. 

With this option, you can selectively restore a file or an application item directly from the backup. If you have accidentally deleted a file, you can easily select and restore that particular file. Also, you can immediately restore a specific mail or mailbox rather than needing to recover the entire database or application. Now, you will be able to achieve an RTO of a few minutes. This saves time and resources as it is not necessary to restore an entire machine every time for recovering an individual item. 

Live replication with failover

Live replication allows you to create an exact copy of your production workloads on another site and frequently replicate the changes to the replica machine configuring near-zero RPO. 

If your source machine becomes unavailable due to any outage or corruption, you can immediately perform a failover operation that seamlessly switches the production operations to your replica machine. Without any downtime or impact, you will be able to continue your business operations while meeting your near-zero RTO goals. In cases where both the RTO and RPO are near-zero, you can leverage the replication and failover functionalities and keep your production workloads always available. 

Offsite copy for disaster recovery

Nobody can predict a disaster. If there is a full-site failure, even your local backups become inaccessible and put your business at risk without being able to recover your data. 

For this reason, it is good to have a disaster recovery plan that allows you to create an additional copy of your backup and store it in a remote location which can either be a local data center or a public cloud. With offsite backups, you can recover your system in the event of a disaster and meet your business recovery objectives easily.

Conclusion

Backup and disaster recovery plans are an extremely important part of the overall process of dealing with a disaster scenario. As discussed above, one of the primary aspects of ensuring continuity of operations in the event of a disaster is correctly specifying the RTO and RPO metrics in your backup and disaster recovery plan. 

Decide on the RTO and RPO values, implement a solution that meets your business SLAs, like SLA monitoring tools,  and keep your business always available.

What is the standard recovery point objective?

What is a good RPO time?

Should RPO be less than RTO?

What are standard RTO and RPO?