Understanding RPO and RTO

Two questions every business needs to answer

When a disaster occurs — ransomware, hardware failure, accidental deletion, or a fire — every business faces two questions:

RPO explained with an example

Imagine a ransomware attack happens on Tuesday at 3:00 PM. Your last backup completed on Monday at 11:00 PM.

If you restore from that Monday backup, you lose everything that happened between 11:00 PM Monday and 3:00 PM Tuesday — approximately 16 hours of work, transactions, orders, and records.

The potential data-loss interval in this scenario is 16 hours; compare it with your RPO target. The question your business needs to answer before a disaster: is 16 hours of lost data acceptable?

RTO explained with an example

After the same ransomware attack, your IT team begins restoring systems. The restoration process takes 28 hours.

The restoration takes 28 hours in this example; compare that measured duration with your RTO target. The question: can your business survive 28 hours without access to its systems?

For some businesses, 28 hours offline means lost revenue, missed deadlines, and angry clients. For others, staff can work manually for a day. The answer depends entirely on the business — and it should be established before an incident, not discovered during one.

The gap problem

An untested recovery plan can hide a gap between recovery objectives and actual capability. The dangerous situation is when the gap between what a business assumed and what was actually true becomes clear during an active recovery:

How to determine the right RPO and RTO for your business

1. Identify your most critical systems — the ones that would stop business operations if unavailable.
2. Estimate how long each critical function can operate manually or on paper.
3. Calculate what a day, 4 hours, or 1 hour of data loss would cost in real business terms.
4. Set an RPO and RTO target that your business can actually survive.
5. Evaluate whether your current backup system can meet those targets — and test it.

Check whether your backup setup was designed and tested against explicit recovery objectives. Knowing your numbers gives you the information to make that a deliberate choice.

Primary sources and scope

These sources support the specific regulatory, provider, or recovery distinctions discussed here, not a complete compliance assessment or a guarantee of results. Confirm applicability, current terms, and your actual configuration before acting.

• NIST: Recovery Point Objective
• NIST: Recovery Time Objective