Recovery time and recovery point objectives (RTO and RPO)

RTO and RPO are the two targets a company sets for recovering after an incident: the recovery time objective (RTO) is the maximum downtime tolerated for a service, the recovery point objective (RPO) the amount of data the business accepts losing, expressed as time since the last usable copy. A four-hour RPO means that at worst four hours of orders get keyed in again. February 2024, Change Healthcare: the UnitedHealth Group subsidiary was breached through a Citrix portal without multi-factor authentication, according to the group CEO's testimony before Congress. Pharmacies and practices that relied on its billing flows waited for weeks. The gap between the recovery clients assumed and the actual recovery became the loss. Both numbers are set per application, after a business impact analysis, and they cost money: an RPO near zero requires continuous replication, an RTO of a few hours a standby site ready to take the load. The application asks for the objectives of critical systems, and above all whether they were met in the last test. The underwriter sets them against the waiting period on business interruption cover, often expressed in hours. A 24-hour RTO against a 12-hour waiting period puts most of the outage on the policy; a fifteen-day RTO with no test evidence leaves an indemnity period that can stretch. The RPO feeds data restoration costs and the margin lost on wiped transactions. A practitioner's caveat: a continuity plan built for fire or hardware failure assumes a clean standby site. After ransomware, replication has often copied the encryption, and the real RTO becomes that of a cold restore.