Here are a few loose quiestions that can help determint RTO.
What are the costs of doing something?
What savings are there for doing it?
What are the costs of maintenance and/or support?
What are the implications of not doing something?
Is there an insurance policy that is available that will cover this “loss” if we do not do this and we have an event that occurs?
Since you spoke about DR. I’ll also include this question to pose when people begin to discuss disaster scenarios. Typicall
One statement you can ask people to fill out that is invaluable in ferriting out the “less than realistic” proposals is:
We want to do X to protect Y from the threat of Z.
For example, you are in California:
We want to “do this” to protect “our mainframe” from the threat of an “Ice storm”.
We want to “do that” to protect “our mainframe” from the threat of an earthquake.
As you can see one is more likely than the other in California– and the opposite is true in Missouri. The goal of this question is to pull out the proposals that are possible, but not likely. Can MO have a earthquake? Yes, the New Madrid fault is supposed to be bigger than the San andreas fault. But it’s not likely.
The question about an insurance policy is also true here. It would be MUCH cheaper to buy business interuption insurance for an earthquake in MO than to go into a whole DR scenario for the possibility that an earthquake might happen in 100 years.
All this is not to lessen the need for a DR plan, but more a balancing of expectations. Generally, the big terrible disasters are always the scenarios companies focus in on. Think about it like this, if terrorists were able to drop a nuclear bomb on New York— how many people would really be concerned about bringing the NY stock exchange backup that worked and lived in the area? None, they all have families and are likely to have problems of their own.