Understanding RTO vs. RPO

If you want to protect your business in the event of a system or network outage, it’s important to carefully evaluate two similar but very different factors:  your recovery point objective (RPO) and your recovery time objective (RTO).

RPO has to do with how much past data you are willing to risk in the event of a catastrophic failure, while RTO addresses how long your business can afford to be down before it generates and stores new data.  Both measures have an important impact on your disaster recovery planning process – and here’s how.

Let’s say you work for a business that uses an e-commerce site to sell unique, handcrafted golf clubs that aren’t available in local sporting goods stores.  These are big-ticket items, and a single order can total thousands of dollars.  Selling your clubs is a multistage process, though, and the various stages may have varying disaster recovery requirements.

On the front end of the sales process are systems your client interacts with directly, such as your online product catalog and your order entry system. You decide your firm simply can’t afford to lose orders placed or in progress in the event these systems go down.  You also can’t afford to sacrifice future orders by having your website unavailable while you are recovering from an outage.  So both RPO and RTO are as close to zero as you can get.

When it comes to the back-end systems used to manage fulfillment and to schedule deliveries of your golf clubs, though, the situation is different. While your back-end processes are still data-intensive, you don’t have the same concerns if you are unable to access past data or record new data for a brief period of time.

What’s the impact of these varying needs on your business continuity plan?  For your fulfillment systems, a backup and restore protection may be enough.  But for critical web servers and e-commerce systems that need to be up 24/7, your company may need fully redundant processors with seamless failover to prevent any interruption of service.  The financial risk of any downtime is simply too great to do otherwise.

So know your organization’s RPO and RTO tolerances before you develop your business continuity plan.  Look across the breadth of your operations to determine whether your downtime tolerance is the same for all your systems or whether it varies by function or location.  You will then be poised to manage both risks and costs as you work with a trusted IT services provider to build your disaster recovery plan.