Determining RTO and RPO

Disaster recovery planning
What questions can be posed or analysis can be done to determine RTO? What questions can be posed or analysis can be done to determine RPO?

Answer Wiki

Thanks. We'll let you know when a new response is added.

Here are a few loose quiestions that can help determint RTO.

What are the costs of doing something?
What savings are there for doing it?
What are the costs of maintenance and/or support?
What are the implications of not doing something?
Is there an insurance policy that is available that will cover this “loss” if we do not do this and we have an event that occurs?

Since you spoke about DR. I’ll also include this question to pose when people begin to discuss disaster scenarios. Typicall

One statement you can ask people to fill out that is invaluable in ferriting out the “less than realistic” proposals is:

We want to do X to protect Y from the threat of Z.

For example, you are in California:

We want to “do this” to protect “our mainframe” from the threat of an “Ice storm”.
We want to “do that” to protect “our mainframe” from the threat of an earthquake.

As you can see one is more likely than the other in California– and the opposite is true in Missouri. The goal of this question is to pull out the proposals that are possible, but not likely. Can MO have a earthquake? Yes, the New Madrid fault is supposed to be bigger than the San andreas fault. But it’s not likely.

The question about an insurance policy is also true here. It would be MUCH cheaper to buy business interuption insurance for an earthquake in MO than to go into a whole DR scenario for the possibility that an earthquake might happen in 100 years.

All this is not to lessen the need for a DR plan, but more a balancing of expectations. Generally, the big terrible disasters are always the scenarios companies focus in on. Think about it like this, if terrorists were able to drop a nuclear bomb on New York— how many people would really be concerned about bringing the NY stock exchange backup that worked and lived in the area? None, they all have families and are likely to have problems of their own.

Discuss This Question: 2  Replies

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.
  • Wrobinson
    This is good but in my opinion, too much for the question asked. We can discuss business continuity and disaster recovery all day. Here, what we really need to look at is how much downtime and data loss is tolerable respectively? To answer this, you have to take a holistic look at the cost of downtime. Take an e-commerce Web site for example. If the Web site does down and as a result, orders and transactions cannot be processed then there is a very real cost associated with downtime which would justify spending on measures to prevent this from occurring. Now let's consider a financial institution as the next example, they are bound by legislation to archive just about everything, so they on the other hand will for all intents and purposes, have a 'zero' tolerance for data loss. Essentially, there needs to be justification for how much to spend on avoidance, mitigation and recovery. The cost of these measures should not exceed the benefit or potential loss.
    5,625 pointsBadges:
  • YuvalShavit
    As Wrobinson pointed out, the question with RPO and RTO is essentially how much you can afford to lose -- in terms of downtime with RTO, or data in terms of RPO -- as compared with how much you have to spend on a solution to not lose it. Depending on your business, location and other factors, you can calculate the chance of a given scenario occurring, how much downtime or loss of data it would cause, how much that loss would cost you, and how much it'll cost to protect against it. Shameless plug, but relevant: I wrote an article for that covers RTO and RPO as part of the larger topic of disaster recovery. Even though it's geared for consultants, it could help you figure out what sorts of factors to look at.
    905 pointsBadges:

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

Thanks! We'll email you when relevant content is added and updated.


Share this item with your network: