Ask a business owner whether they have backups and the answer is usually yes. Ask how much work they would lose, or how long they would be offline, if the server died this afternoon, and the answer is often a shrug.
Those two questions have names. They are called RPO and RTO, and they are the most useful way to decide what kind of backup and recovery your business actually needs.
RPO: how much data can you afford to lose?
RPO stands for recovery point objective. It is the maximum amount of recent work you could lose, measured in time.
If your backup runs once a night at 11 p.m. and the server fails at 4 p.m. the next day, everything done since the last backup is gone. That is up to about 17 hours of work. Your RPO, in practice, is one day.
- An RPO of 24 hours means you accept losing up to a day of work.
- An RPO of 1 hour means backups or snapshots run at least hourly.
- An RPO of minutes usually means continuous replication or cloud services that save changes as you go.
A simple test: imagine re-entering every invoice, email and file change since your last backup. How far back can you stand to go?
RTO: how long can you be down?
RTO stands for recovery time objective. It is how long it should take to get a system working again after a failure.
This is different from RPO. You might have a backup from five minutes ago, but if restoring a full server takes two days, your staff cannot work for two days. RTO covers the whole process: noticing the problem, getting replacement hardware or cloud capacity, restoring the data and checking that it works.
- An RTO of a few days may be acceptable for an archive or a rarely used system.
- An RTO of a few hours usually requires a recent image backup and a way to run it quickly.
- An RTO under an hour typically needs standby systems that can take over almost immediately.
How to set your own targets
Do not try to pick one number for the whole business. Different systems matter in different ways.
- List your key systems. Email, accounting software, file shares, line of business applications, phones and internet.
- Ask what happens if each one is gone. Who stops working? Do customers notice? Is there a deadline or legal obligation that would be missed?
- Estimate the cost of downtime. Think about lost billable hours, missed orders, overtime to catch up and the impact on your reputation.
- Set an RPO and RTO for each system. Be honest. "Zero data loss and zero downtime" is very expensive and rarely necessary.
- Compare against what you have. Check how often backups actually run and how long a real restore takes.
Many small offices find that email and cloud files are already in good shape, while an old accounting server or a single NAS is the weak link.
Matching backups to your numbers
Once you know your targets, the technology choice gets much easier.
- Long RPO and long RTO: nightly cloud backup may be enough.
- Short RPO, longer RTO: frequent snapshots or backups throughout the day, with a restore process that may take a while.
- Short RPO and short RTO: image based backup with the ability to start a server in the cloud or on a local appliance while the original is repaired.
Shorter targets cost more. The goal is to spend where downtime hurts most, not everywhere equally.
Plan for the bad days, not just failed drives
RPO and RTO apply to more than hardware failure. Ransomware, a fire, a long power outage or a building you cannot enter all change how fast you can recover. Southern California offices also need to think about earthquakes. Our post on earthquake readiness for office IT covers that side of planning.
For each scenario, ask whether your restore plan still works if the office itself is unavailable. If the only backup copy is in the same building, the answer is probably no.
Test and write it down
Targets are only useful if you check them. Run a restore test at least once or twice a year, time it, and compare the result to your RTO. Record the numbers in a one page continuity plan that names who does what. Then review it when you add new systems or staff.
Getting help
Creative IT USA helps businesses across Los Angeles County, the Inland Empire and Ventura County set realistic recovery targets and build backup to match. Learn more about our business continuity planning and backup and disaster recovery services.