How long can your business be down? Setting recovery targets
Recovery time and recovery point targets, explained in plain English: how to set them for each system in an afternoon and spot where your backups fall short.
Ask a business owner how quickly they need their systems back after a failure and the honest answer is usually "immediately". Ask how much work they could afford to lose and the answer is "none". Neither is a plan. Recovery targets turn those wishes into two numbers for each system, and those numbers tell you what kind of backup and recovery setup you actually need. This guide shows how to set them in an afternoon, without jargon.
The two questions behind RTO and RPO
IT people use two abbreviations. You only need the questions behind them:
- How long can we be without this? That is the recovery time objective (RTO): the longest the business can run without a system before the damage becomes serious.
- How much recent work can we afford to redo or lose? That is the recovery point objective (RPO): if we restore from backup, how old can that backup be?
A system with a four-hour RTO and a one-hour RPO needs to be back within four hours and must not lose more than the last hour of changes. A system with a three-day RTO and a one-day RPO can be handled very differently, and far more cheaply.
Step 1: list what the business actually runs on
Write down the systems, not the hardware. For most small offices the list looks something like this: email; shared files; the accounting or bookkeeping system; the line-of-business application (practice management, CRM, design files, inventory); phones; the internet connection; and the website or online store. Add anything staff would phone you about within the first hour if it stopped.
Step 2: ask the people who use each system
For each item, ask the person who depends on it what happens after one hour without it, after one day, and after one week. You will often get surprising answers. Email may be tolerable for half a day because phones work. Payroll software may not matter at all until the day before payday, then become urgent. Design or project files may be the real heart of the business. Write down the point where an outage stops being an inconvenience and starts costing clients, money or legal trouble. That is your recovery time for that system.
Then ask how much work would be lost if the system jumped back to yesterday's state. For a shared folder that changes all day, losing a day may mean many hours of rework across the team. For a website that changes once a month, a week-old copy may be fine. That is your recovery point.
Step 3: put it in a simple table
A table with five columns is enough: system, who owns it, recovery time, recovery point, and how it is protected today. Rank the rows by recovery time, shortest first. The top of that list is what you restore first in a real incident, and it is also where your money should go.
Step 4: compare the targets with what you really have
This is where gaps show up. Common ones:
- A nightly backup protecting a system with a one-hour recovery point. Either back it up more often, use snapshots, or accept the risk in writing.
- A backup that would take two days to restore for a system you need back in four hours. Restoring large amounts of data from the cloud over an office internet line can take far longer than people expect.
- Cloud services assumed to be covered. Microsoft 365 and similar services keep your data available, but their deleted-item and version limits are not the same as a backup you control.
- Systems nobody listed, such as the firewall configuration, the domain name login, or the one PC that runs an old but essential program.
Step 5: decide, then test
For each gap, choose: improve the protection, change how the business would work around the outage, or accept the risk knowingly. All three are valid; the problem is choosing by accident. Then prove the numbers. A test restore drill tells you whether a recovery really fits inside your recovery time, and our guide on how long to keep backups covers the separate question of how far back your copies should go.
Review the table once a year, and whenever you add a new system, move office, or change how the team works.
How we can help
We can work through the table with you and match backups and recovery steps to each target as part of our disaster recovery planning and managed backup services. Call (213) 986-4855.