Businesses must establish specific goals for disaster recovery, including the recovery point objective (RPO) and recovery time objective (RTO). RPO refers to the acceptable amount of potential data loss, while RTO is the targeted time from the moment of failure to data recovery. Different backup and recovery systems offer varying degrees of accessibility, security, and recovery speed. Cost must be weighed against actual critical information recovery needs.
In today’s computer-driven economy, businesses must respond to the danger of data loss and costly downtime associated with hardware and software malfunctions, equipment failures, acts of terrorism, and natural disasters. As part of any business impact analysis, management must establish specific goals for disaster recovery, including the recovery point objective (RPO). The recovery point objective is the retroactive period to which data can be recovered after a disaster and still allow the business to resume normal operations. In other words, RPO refers to the acceptable amount of potential data loss, in terms of time, that the company can tolerate. The recovery point objective determines how often key business data is backed up and the technology involved in that process.
While it may seem prudent to keep all data backed up up to the minute, the cost of doing so could be prohibitive, particularly if a business wants to store information off site. Each company must carefully weigh its actual critical information recovery needs against the costs of a proposed recovery system. For example, banks and exchanges cannot tolerate any data loss, which requires an updated or ongoing “RPO point of failure.” A medical office has critical patient and financial data on its computer system, but can resume operations if the information is restored from the previous night’s backup, called a “closed-of-business RPO.” Finally, a teenager who plays games and surfs the web on her home computer may have a “Zero RPO,” meaning she doesn’t have a serious need for backups.
In addition to the recovery point objective, a business continuity plan also contains a recovery time objective (RTO), a targeted time from the moment of failure to data recovery. For example, a company may decide that it must resume normal operations within six hours of a disaster in order to minimize financial losses. The data recovery systems used by the company must provide complete recovery of critical data within a six hour window. While the RPO determines the backup frequency, the RTO determines the recovery technology. Different ways of backing up and recovering from tapes, disks, external hard drives, online storage, and alternative physical sites linked by telecommunications systems all offer varying degrees of accessibility, security, and recovery speed.
Several key factors go into determining a recovery goal. First, business management must separate information that is absolutely essential for basic operations to reduce the cost of data replication and storage. If a business wants to reproduce and archive all data, including non-critical data, it may be necessary to reduce the frequency of replication to keep costs down. For continuous recovery systems, the reliability of data replicated during a long-term disaster cannot be guaranteed. If the company wants regional protection, with offsite storage, the cost of maintaining dark fiber, DWDM (dense wave division) technology, or telecommunication lines will require longer RPOs.
Protect your devices with Threat Protection by NordVPN
