RPO and RTO explained with a real disaster recovery example

In this Help Net Security video, Matthew Burden, CEO of BlackBox Hosting, explains RPO and RTO and how they differ in practice. RPO, the recovery point objective, is the most data you can lose, measured in time. RTO, the recovery time objective, is the longest your business can stay down. A backup does not guarantee quick recovery, and quick recovery does not help if the data is days old.

Burden says every application needs its own targets, and a four-hour RTO means little until someone has tested it. He suggests testing each quarter, not once a year.

He also shares a customer example with more than 1,200 virtual machines, a contractual one-second RPO and a four-hour RTO. Data replicates between two data centers, and standby hardware stays ready. In quarterly tests, the environment starts in about 90 minutes.

His advice: set targets based on business needs, then test them often.