Recovery time objective
The RTO is the target time to restore a service after disruption. It should be measured from a defined starting point and should identify what “restored” means.
A service may be technically online before data validation, user access or dependent processes are ready.
Recovery point objective
The RPO is the maximum acceptable amount of recent data exposure measured in time. An RPO of one hour implies that recovery methods should normally preserve data no more than one hour behind the disruption.
The RPO is not the same as backup frequency unless backup completion, retention and restoration are also considered.
Validate the objectives
- Confirm the business owner accepts the impact
- Verify dependencies can meet the same or tighter objectives
- Measure actual recovery during a test
- Include credentials, DNS, network and supplier actions
- Record gaps between target and demonstrated performance