Safeguards
RTO and RPO
What do RTO and RPO mean?
RTO and RPO are the two numbers that make recovery plannable. The RPO (recovery point objective) says how much data you may lose when it counts. The RTO (recovery time objective) says how long operations may stand still.
An example. If a backup runs daily at 22:00 and the server fails the next day at 16:00, eighteen hours of work are gone. That is your actual RPO. If you want to lose at most one hour, a backup has to run every hour. The question is therefore no longer a technical one, it is a commercial one.
The RTO is regularly underestimated. It does not cover restoring the data alone. It covers noticing the outage, deciding, procuring replacement hardware, restoring, checking and releasing. Anyone who has never rehearsed a restore does not know their RTO, they estimate it.
Set both numbers per application. Accounting, inventory management and the archive rarely share the same urgency. From the numbers follows how often backups run and what replacement systems must stand ready.
All terms in the knowledge base
Note: This entry reflects the state of knowledge to the best of our understanding and serves as general orientation. It is not legal advice. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT. The first call takes 20 minutes and carries no charge.