How to determine RTOs and RPOs for backup and recovery

When evaluating the design of your backup systems or developing a design of a new backup and recovery system, there are arguably only two metrics that matter: how fast you can recover, and how much data you will lose when you recover. If you build your design around the agreed-upon numbers for these two metrics, and then repeatedly test that you are able to meet those metrics in a recovery, you’ll be in good shape.

The problem is that few people know what these metrics are for their organization. This isn’t a matter of ignorance, though. They don’t know what they are because no one ever created the metrics in the first place. And if you don’t have agreed upon metrics (also known as service levels), every recovery will be a failure because it will be judged against the unrealistic metrics in everyone’s heads. With the exception of those who are intimately familiar with the backup and disaster recovery system, most people have no idea how long recoveries actually take.

First, let’s understand what these two metrics are, and then let’s discuss how to get others to agree to them.

The two metrics are recovery time objective (RTO) and recovery point objective (RPO). RTO is about how fast you need your operations back on track after a disaster, while RPO is essentially the data you can afford to lose when things go south. For example, you might say that we need to be able to restore our environment to fully operational status within four hours of any kind of outage, and we can only lose one hour’s worth of data. That is a four-hour RTO and a one-hour RPO.

The most important thing for you to know about RTO and RPO is that it is not your job to set these values. RTO and RPO come from the top and must be determined by a combination of stakeholder needs and the financial cost of meeting those needs. It is a business decision, not a technical one.

To get everyone in your organization to agree to metrics, you first must find all those who would have an opinion on such things. These are your stakeholders and subject-matter experts. These folks hold the keys to understanding what each department within your organization really needs to have safeguarded and how crucial it is to keep things up and running. These people are essentially your customers, and you need to find out what they want for RTO and RPO.