Safeguards
RTO and RPO
What do RTO and RPO mean?
RTO and RPO are the two numbers that make recovery plannable. The RPO (recovery point objective) says how much data you may lose when it counts. The RTO (recovery time objective) says how long operations may stand still.
An example. If a backup runs daily at 22:00 and the server fails the next day at 16:00, eighteen hours of work are gone. That is your actual RPO. If you want to lose at most one hour, a backup has to run every hour. The question is therefore no longer a technical one, it is a commercial one.
The RTO is regularly underestimated. It does not cover restoring the data alone. It covers noticing the outage, deciding, procuring replacement hardware, restoring, checking and releasing. Anyone who has never rehearsed a restore does not know their RTO, they estimate it.
Set both numbers per application. Accounting, inventory management and the archive rarely share the same urgency. From the numbers follows how often backups run and what replacement systems must stand ready.
All terms in the knowledge base
Legal notice: We are engineers, not lawyers: we cannot and will not make any statements on legal questions. This entry is purely technical, reflects the state of knowledge to the best of our understanding, and is not legal advice; it does not replace review by a qualified lawyer. No guarantee is given as to correctness or completeness; liability arising from the use of this information is excluded to the extent permitted by law. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu. AI transparency: parts of this entry may have been created with AI assistance, so errors are possible despite review: please report errors here · how we create content.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT.
office [at] vetosec [dot] at · vetosec.at/contact/
