The recovery time objective (RTO) is the length of time within which a business process should be recovered after an outage or downtime. Put another way, how soon will you have a given system back online? This should be set with the previously discussed maximum tolerable downtime (MTD) in mind.

It’s important to understand that the RTO relates to the business process. It does not relate to the dependent components, such as the technology. The RTO is the measurement of how quickly individual business processes should be recovered. The RTO is a natural extension of the BIA. It identifies the maximum allowed downtime for a business process. The maximum allowed downtime is based on the business tolerance for loss. This, in turn, becomes the RTO. That is why the business continuity planner is part of the BIA process.

The continuity planner understands the capabilities of the organization to recover from a disaster. The planner should be able to catch an unrealistic RTO set by the business during the BIA process. For example, the business may state that it requires near real-time recovery of its applications in the event of a disaster. Few organizations can achieve that goal. The BCP planner facilitates a candid discussion on the cost of recovery and the organization’s capabilities. The continuity planner can also push requirements that increase costs.

RTO policies often include a discussion of recovery point objectives (RPOs). The RPO is the maximum acceptable level of data loss from the point of the disaster. Consider an example wherein the company backs up a server every hour. In the event of a hard drive crash, the company could lose up to 59 minutes’ worth of data. The organization must ask whether this is acceptable. If it is not, then backup strategies must be re-examined.

The RPO can be shorter than the RTO. In that case, the business is saying the business process can be down longer. However, when business operations resume, the business needs the data from an earlier point, such as the point of outage. It’s important to understand that the RPO relates to the data, not to a single RTO. When you look at the RTO and RPO, the requirements to recover a business successfully emerge. These requirements drive the selection of recovery technology and design of the BCP.