RPO vs RTO: Setting Recovery Targets the Business Can Live With
How much data can you lose, and how long can you be down? We turn those answers into targets and check your backups against them.
99.9% availability still allows 8.8 hours of downtime a year
Availability targets sound close together. In hours they are very different, and so is the cost of meeting them.
A recovery target is only real once a restore has met it
We compare measured restore times with each RTO and show the gap in hours.
RPO and RTO in plain terms
The recovery point objective (RPO) is the most data, measured in time, the business can afford to lose. A 4-hour RPO means backups must run at least every 4 hours. The recovery time objective (RTO) is how long a system can be down before the damage is unacceptable.
Both come from a business impact analysis, not from the backup product. NIST’s contingency planning guide (SP 800-34) describes this process. The audit checks whether targets exist, who approved them, and whether your backups and restore times actually meet them.
Uptime or availability targets describe how much of the year a service must be running. They matter most for cloud services and anything customers use directly.
Availability targets in hours
| Availability target | Allowed downtime per year | Allowed downtime per month (30 days) |
|---|---|---|
| 99% | 87.6 hours | 7.2 hours |
| 99.5% | 43.8 hours | 3.6 hours |
| 99.9% | 8.76 hours | 43.2 minutes |
| 99.95% | 4.38 hours | 21.6 minutes |
| 99.99% | 52.6 minutes | 4.3 minutes |
Calculated from 8,760 hours per year and 720 hours per 30-day month.
What we look for and why
Tier your systems
Not everything needs a 1-hour RTO. Tier 1 might be email, identity and the core business app; tier 3 might be an archive. Each tier gets its own targets and restore order.
Include the dependencies
A database restores in an hour, but not before identity, DNS, network and licensing are back. The restore order must include them.
Leadership signs off
Targets cost money. Owners should approve them, and the gaps, in writing.
A finding from the sample report
- Area
- Recovery objectives
- Finding
- RTO for the ERP system is 4 hours, measured restore took 19 hours
- Severity
- High
- Evidence
- The DR plan sets a 4-hour RTO for the ERP database server. The only recorded full restore test (March) took 19 hours, mostly copying 2.1 TB from cloud storage over a 200 Mbps link.
- Fix
- Keep a local restore copy for tier 1 systems, size the off-site restore path, or agree a realistic RTO with leadership and record the accepted risk.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Disaster recovery plan and DRaaS
Failover when restore is too slow.
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 4 of 16: RPO, RTO, uptime & availability
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability (this page)
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
What is the difference between RPO and RTO?
RPO is about data loss: how far back you can afford to go. RTO is about downtime: how long you can be without the system. A system can have a short RPO and a longer RTO, or the reverse.
Who should set RPO and RTO?
The business owners of each system, with IT explaining cost and feasibility. The audit checks that targets exist, are approved and match reality.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Turn recovery targets into numbers you can prove
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.