RPO and RTO: how much you can lose, and how long you can be down

RPO, the recovery point objective, is how much work, measured in time, the business can afford to lose: it is set by how often the backup runs. RTO, the recovery time objective, is how long the business can afford to be down: it is set by how long the restore takes. Both are promises, and both are numbers you can check against a clock.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

The accounts server's disk dies at 14:00. The last backup ran at 22:00 the night before. Sixteen hours of invoices are gone, and the restore will take three hours. The director asks two questions, and only two: how much did we lose, and when are we back. RPO and RTO are those two questions with numbers on them, agreed before the disk died.

How to think about it

Work lost = the time of the failure minus the time of the last good backup; compare it with the RPO, and if it is larger, the backup was not running often enough. Downtime = the time to notice, plus the time to restore, plus the time to verify; compare it with the RTO. Write both against the promise in the ticket, because the gap between the number and the promise is the case for a better backup.

Worked example

Failure 14:00. Last backup 22:00 the night before

The two times that decide what was lost.

Work lost = 14:00 − 22:00 (previous day) = 16 h. RPO promised: 24 h → met

Sixteen hours of work gone, inside the promise. Nightly was enough, this time.

Restore: 3 h to copy back, 30 min to check → back at 17:30. RTO promised: 4 h → met, with 30 min to spare

Three and a half hours down, against a four-hour promise.

Note: 'lost 16 h against RPO 24 h; down 3.5 h against RTO 4 h'

Both numbers against both promises. That line is what the next backup budget is decided on.

Your turn

Backups run every 6 hours. The disk fails 2 hours after the last one. Write the work lost.

Work lost =  h

The trap

Quoting the RPO as the work lost. The RPO is the worst case the business accepted; the work lost is the actual gap between the last backup and the failure, which can be smaller, and, if the backup had been failing quietly, much larger.

Practise RPO and RTO on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.