Recovery Point Objective (RPO)

The RPO represents the amount of data your company can afford to lose during a disruption. Of course, it’s easy to say “none”, and setting this parameter to zero is a real possibility, but that’s an expensive undertaking.  So in determining “acceptable loss”, we have to weigh the cost of lost data against the cost of setting a zero-tolerance loss parameter. More likely, you may determine that it is okay to lose 24 hours-worth of data so your RPO is set to 20 hours, just to be safe. Or it may be set to two hours, or one hour, or five minutes…all are possible. Of course, your managed IT service provider needs to understand the complexities of your network and how to accomplish this…experience here is critical.

Recovery Time Objective (RTO)

A disruption isn’t just about how much data you are willing to lose, it’s also about how long you are willing to be down. Again, time is money and the more quickly you need to be fully up and running, the more it will cost.

Let’s look at two different types of businesses and how they might look to set their RPO / RTO objectives.

Data Input Company (DI): This company collects data from its clients, enters it into a database, then provides this digitized information to the clients that sent it in the first place. The data may be entered by hand or by optical reader or from spread sheets, etc. Here is the important point: the original information from the clients should remain available. If DI’s system crashes and a significant amount of data is lost (let’s say a full week’s data), DI will have either the physical records (maybe paper surveys, return postcards or spreadsheets) from which to re-create the digital records. Records that had been emailed from clients will either be available from DI’s email servers or from the clients themselves. The lost files will be rebuilt. DI, of course, will have to bear the cost of paying its employees overtime, or hiring temporary workers, to accomplish this, but this may well be an acceptable risk.

Online Retail Company (OR): OR is a young, growing business with a growing customer base, and a growing email list. Two days ago, it emailed its customers news about its Spring Sale and the orders have been pouring in. At 2 PM today, its network went down due to an equipment failure and all the orders that had been taken over the past 24 hours were corrupted. Several things happened: although they have no record of the sales that had been made, the money received from hundreds of now unidentifiable orders is in the bank. Yes, each deposit is traceable to a sales receipt…except that the sales receipts have vanished. Number 2: new orders are stopped dead in their tracks because although their site is still up, the data they need to sell product is gone. As we can see, this is a company that can ill afford long RPO or RTO. Every minute that cannot be recovered is money lost, or customers who have paid but who will not be receiving their merchandise. This is a company that needs to be back up and running, with files fully restored, just as quickly as possible.

Types of Data Backups and How They Affect RPO / RTO

Simply put, you cannot restore corrupted or deleted data if you don’t have that data saved in another place. Hence: backups. (Note: Don’t confuse a “backup” with an “archive”. While a backup is a copy, an archive is, or becomes, the “original” file. The data, rather than being simply copied, is transferred to another medium, usually tape, which is less expensive to store long-term. The files that are archived are important to save, but unlikely to be needed in the near-term – possibly ever. Archived files are sometimes backed up onto a second set of tapes and stored in a separate facility. This is recommended.)

We are going to take a look at the most common types of back-ups: full backups, incremental backups, and differential backups. As you might expect in today’s tech world, there are other variations including synthetic full backups, mirroring, reverse incremental and continuous data protection.