Recovery Time Objective (RTO) & Recovery Point Objective (RPO): 2 Most Critical Parts of Your Disaster Recovery Plan

Whether by accident or pre-planning, you know that backups are necessary. If you don't have a backup, stop right now and read about data backup and storage options for businesses - but make sure you come back and read this once you are done.

Today, we're going to talk about disaster recovery. It’s vital to understand that backups and disaster recovery are not the same.

In a nutshell, backups are used to recover incidental lost data, like recovering a deleted file or folder. Small, everyday accidents or mishaps. Disaster recovery is used to restore a company after a massive data loss event. Think a fire, a flood, or a severe virus infection.

But, of course, there's more to the story. So, let's get on with it.

Do I Need to Keep My Backup Files Off-Site?

A well-rounded disaster recovery plan includes a copy of your backups saved off-site.

Here’s an example of why that’s important:

What if a water pipe breaks over your server room, flooding the area and destroying all the equipment inside? If your server and backups are both in that room, they're both potentially ruined. That could leave you with a massive or total loss of critical company data.

Unfortunately, things like that happen every day. So, it’s important to implement a disaster recovery solution that protects you from all kinds of situations and allows you to restore from either local or offsite storage. 

I’m sure you can think of 100 more “likely” scenarios all ending in a total loss. So, why risk it?

Economic Data Storage Options

The good news is that a variety of methods of getting your data off-site have become very cost-effective in recent years. One of the more economical options is using USB drives, however, it’s important to note it’s not one we would normally recommend.

With this method, people often swap out a rotation of USB drives every day onsite, or maybe use the same drive several days in a row.

Then to add off-site protection, people may swap out for another USB drive and the current weeks' backup would be taken off-site. This is a VERY common, inexpensive way to get some off-site protection.

Now, you're probably thinking, "What's the risk in using this method?" -- great question!

First of all, USB drives are highly prone to failure. They fail suddenly, without warning, and recovering a failed USB drive can be extremely expensive if it works at all. So, you're always at some risk when you are using a USB drive.

You probably don't want to trust your entire company's data history to a USB drive. If that drive fails, that means everything's gone.

How Much Time Will It Take to Recover My Data?

There are two main components to understanding how long your data recovery will take.

One is Recovery Time Objective, and the other is Recovery Point Objective. Sure, they sound the same, but they measure different things. 

It’s important that you consider each one separately and honestly answer how much time you’re willing to risk losing for each.

Recovery Time Objective

The recovery time objective measures the amount of time it will take to restore service after a disaster.  Depending on the type of solution you choose, you can recover as quickly as just a few minutes or hours, or it may take multiple days or even weeks to rebuild your servers.  So, it’s important that you consider how long your business can be without your applications and data. 

Drawing on the example of a pipe breaking from earlier, let's say your email server is destroyed.

Some companies may be okay being down for a few days, it’s not ideal but maybe it won’t kill you. While there are others who couldn't last an hour without their email, it's that critical.

Ask yourself where you land on this scale. It's important to be honest about it because when a disaster happens, the disaster recovery solution you choose will determine how quickly you can be back online. 

You're looking for a sweet spot, for some, it's the least amount of time possible, for others it's a while longer. Start the disaster recovery conversation by asking yourself how critical a loss would be on daily business operations. 

Recovery Point Objective

Recovery Point objective measures how much time has passed since your last backup.  This time is the amount of data you may lose in case of a disaster.

This, again, is very customizable.

Everyone's backup is set to a given period of time. That amount of time could be 4 hours, 8 hours, or once a day for example. This increment should be set to the amount of work you'd be willing to lose in a disaster. 

Let's say it's set to take one backup each night at 6:30 PM. Now, hypothetically, something terrible happens at 3:30 PM. Based on your backup schedule, you'd lose that entire days’ worth of work.

Now, you're probably thinking, "But why? I have a backup. It should be fine." 

The problem is that your one backup of the day isn't until 6:30 PM and your system's hiccup happened at 3:30 PM. This means that between 6:30 PM the night before and 3:30 PM of the current working day, no backup was recorded.

Imagine the repercussions of only backing up once every three days or weekly. How would that affect your company?

The important question to ask yourself here is: What will it cost me to recreate a week's worth of work?

How much could the losses of orders, creation processes, or even billable hours cost you? Would that loss cost me more or less than setting my recovery point objective to 8-hour increments instead of 24-hours or 4-hours instead of 12-hours etc.?

And again, wherever you land on that scale is totally fine as long as you’re comfortable with it. There are solutions for all ranges of that scale that vary in costs, speed and performance.

The goal of this article is to help you define your Recovery Time Objective and Recovery Point Objective to build or supplement your disaster recovery plan. When both of those are addressed and effectively covered, your disaster recovery plan will be ready to save you from whatever trouble might come your way.

Have more questions? We're happy to chat anytime. Give us a call at 800-481-4369

Ask an IT Guy

We know that sometimes, figuring out the question is harder than finding the answer.

Ask an IT Guy was created with you in mind. This bi-monthly blog series will help you get to the bottom of IT questions you didn't even know you had.