RPO vs RTO: what they mean and why they matter
Short answer: RPO (Recovery Point Objective) is how much data loss the business accepts, expressed as a point in time. RTO (Recovery Time Objective) is how long the business accepts being without the service.
Definition
RPO and RTO are not product metrics. They are business objectives that translate into architecture. RPO asks how far back in time it is acceptable to return. RTO asks how long the interruption may last. An estate can have a demanding RPO and a generous RTO, or the reverse. Treating them as a single figure hides who decides and what has to be built.
What RPO is
RPO sets the maximum data loss the business accepts. If the last usable recovery point is four hours old, that service’s RPO cannot be tighter than those four hours unless another data path exists.
It conditions how often copies are taken, whether replication is needed, and whether transactions must be protected, not only end-of-day files. It does not say how long the service will take to return.
What RTO is
RTO sets the maximum time the business accepts without the service restored to a usable state. It includes detecting the incident, choosing the restore point, running recovery and validating that operations can resume.
It conditions procedure, people, workload order and whether the restore fits the business window. A short RTO is not met by frequent copies alone.
Why both affect architecture
A tighter RPO usually requires more frequent copies or replication. A tighter RTO usually requires a rehearsed restore, ready infrastructure and, often, a backup target from which you can boot or restore quickly.
If the CISO sets immutability and the CIO sets downtime, those are two requirements. Architecture has to satisfy both.
In the Azuba model
Data Protection & Resilience works backwards from the restore: objectives first, then capabilities, then vendors. Azuba does not publish generic numeric targets or an RPO/RTO calculator.
In Data Protection & Resilience, Rubrik covers cyber resilience and identities. Keepit covers SaaS outside the provider. Specific value is assessed in the customer’s environment.
Continue
What should my organization’s RPO or RTO be?
The business sets that per service, not a vendor and not a web page. A target copied from another sector is usually either unreachable or irrelevant. Azuba does not recommend generic figures.
Can a vendor guarantee an RPO or RTO?
Only if that guarantee is verified for a specific environment. On this site Azuba does not attribute numeric targets to any vendor.