RPO (Recovery Point Objective) and RTO (Recovery Time Objective) are the two targets a business uses to decide how much data it can afford to lose and how long it can wait after an outage. RPO measures acceptable data loss; RTO measures acceptable downtime.
How it works
RPO is expressed as a period of time: the maximum acceptable gap between the latest recoverable point and the moment of the incident. If a system has an RPO of one hour, its backup or replica must run at least that often.
RTO is also a period of time: how long may pass between the interruption and the moment the process is back at an acceptable service level. It covers diagnosing, restoring, checking and reopening the service to users, not just copying data back.
Both are set per business process, not per tool. Invoicing, email, production and an archive of old documents have different impacts and therefore different targets. To set them, start from the impact of an outage, the dependencies between systems and the restoration capacity you actually have.
Example
An illustrative example with invented figures. A distribution company backs up its invoicing ERP every night at 02:00. If the server fails at 16:00, everything done since 02:00 is lost: fourteen hours of transactions, and almost twenty-four at the worst moment of the day. Management decides it can redo one hour of work at most, so that system needs much more frequent backups or replication.
In a timed restore test, recovering the ERP takes nine hours, but the company can only stay without invoicing for four. The measured RTO misses the target: either the recovery method changes or the target is revisited with real data. The archive of old documents, by contrast, may have an RPO and RTO of several days without the business noticing.
Common mistakes
A backup that finished successfully proves neither RPO nor RTO; only a measured test restore does. A single value for the whole company does not work either. And before accepting a target in writing, ask any provider what is measured, from when, and how it is verified.
When to call an expert
Ask for help when it is unclear which systems stop the business, when nobody has ever timed a restore, when a customer, an insurer or an audit asks for continuity evidence, or when the infrastructure has changed (cloud, Microsoft 365, a new office) and the targets have not been reviewed.
A specialist helps rank systems by impact, turn the targets into a backup policy and confirm with test restores that they are met. At Impulso Tecnológico we work on diagnosis, technical controls and training: see our managed IT services, the guide RPO and RTO for businesses or tell us about your case.
Learn more
Related glossary terms: the 3-2-1 backup rule, immutable backup, disaster recovery and business continuity plan.
Official source: NIST SP 800-34 Rev. 1, the contingency planning guide, and the NIST glossary definitions of RPO and RTO.