# RTO and RPO

**What do RTO and RPO mean?**

RTO and RPO are the two numbers that make recovery plannable. The RPO (recovery point objective) says how much data you may lose when it counts. The RTO (recovery time objective) says how long operations may stand still.

An example. If a backup runs daily at 22:00 and the server fails the next day at 16:00, eighteen hours of work are gone. That is your actual RPO. If you want to lose at most one hour, a backup has to run every hour. The question is therefore no longer a technical one, it is a commercial one.

The RTO is regularly underestimated. It does not cover restoring the data alone. It covers noticing the outage, deciding, procuring replacement hardware, restoring, checking and releasing. Anyone who has never rehearsed a restore does not know their RTO, they estimate it.

Set both numbers per application. Accounting, inventory management and the archive rarely share the same urgency. From the numbers follows how often backups run and what replacement systems must stand ready.

## Related terms
- [Backup and restore](https://vetosec.at/en/it-security/backup-wiederherstellung/)
- [IT emergency plan](https://vetosec.at/en/it-security/notfallplan/)
- [The 3-2-1 backup rule](https://vetosec.at/en/it-security/drei-zwei-eins-regel/)
- [Ransomware](https://vetosec.at/en/it-security/ransomware/)

## Source
https://vetosec.at/en/it-security/disaster-recovery/ (vetosec, schutz)