Creating a business continuity plan can be daunting; especially if it’s the first time you or your team have approached it. If you’ve read around the subject in preparation, you may have noticed a couple of key acronyms: RPO and RTO. These are the factors that will ultimately influence your disaster recovery and data protection strategies. Let’s take a look:

Recovery Point Objective (RPO)

A company’s RPO is all about data. When a disruption occurs, it describes the length of time that can pass before the amount of data being lost goes beyond the limit that a company has decided is acceptable.

For your business continuity plan, you’ll need to assess how long you can operate without data before you or your customers start to suffer. This will determine the ideal back-up time for your data. If you find that your business can survive for a day between backups then the RPO would be 24 hours. If your business can only survive 6 hours between backups then the RPO would be 6 hours. It really comes down to how much data you can realistically manage without, should it be lost in the event of a disaster.

Recovery Time Objective (RTO)

A company’s RTO focuses on time. Essentially, it’s the length of time you have to get everything back up and running as normal after the impact of a disruption.

The main aim is to calculate how quickly your business needs to recover in order to avoid unacceptable consequences. The RTO calculation can help you work out a detailed recovery process, including the preparations that need to be in place in case of a disaster and the budget that should be assigned to business continuity. For example, if you have a recovery time of just 5 hours, then there must already be preparations in place to help you achieve this, such as a third-party data backup service or an alternative work environment. This would allow for you to recover in a much shorter time frame. A shorter RTO is likely to mean higher costs – but will preserve your reputation and minimise financial loss – so your budget must allow for this.


The main difference between RPO and RTO is the overall purpose – and there is a clear relationship between the two. RTO is larger scale and looks at the business as a whole, whereas RPO focuses on data and your resilience to the loss of data. Giving careful consideration to both when creating your Business Continuity Plan will ensure that you’re fully prepared.