RTO and RPO are two of the most important concepts in business continuity - and two of the most commonly misunderstood. If you pay for backup and disaster recovery without knowing your RTO and RPO, you may be buying the wrong solution.
RPO - Recovery Point Objective
RPO is about data loss. It answers the question: how much data can we afford to lose?
If your backup runs every night at midnight, and a failure happens at 4pm the next day, you could lose up to 16 hours of data - everything created or changed since the last backup. Your RPO in that scenario is 16 hours.
For a business that generates a lot of transactions - a medical practice, a legal firm, a busy retail operation - 16 hours of lost data could mean thousands of lost records, payments, or appointments. For a business that changes data slowly, it might be manageable.
To set your RPO, ask: “What is the maximum amount of data we could afford to re-create or permanently lose?”
- 1 hour of data? Your backup frequency needs to match that.
- 4 hours? You need backups every 4 hours or less.
- 24 hours? A nightly backup may be sufficient.
RTO - Recovery Time Objective
RTO is about downtime. It answers the question: how long can we afford to be offline?
If your server fails at 9am and your IT team needs 8 hours to rebuild and restore everything, your actual recovery time is 8 hours. If your business requires 2-hour recovery, there's a serious gap.
To set your RTO, ask: “At what point does system downtime become a serious problem - financially, operationally, or reputationally?”
- A clinic that can't access patient records might have an RTO of 2 hours.
- A construction firm with field workers and a backup paper process might tolerate 24 hours.
- A law firm with court deadlines might need an RTO of under 1 hour for specific systems.
Why this matters for your backup setup
Most small businesses are set up with a “we have backup” configuration - usually a nightly backup to an external drive or a basic cloud service. Nobody has ever asked what the RTO and RPO actually are.
The result is that when something goes wrong, the recovery takes far longer than expected and the data loss is far greater than acceptable. Both of these surprises were preventable.
Low RPO requires more frequent backups
If you need an RPO of 1 hour, you need backups running hourly. Technologies like continuous data protection (CDP) or image-based backup with frequent snapshots are designed for this.
Low RTO requires different recovery technology
Restoring from a traditional backup to a physical server takes hours. If you need a 2-hour RTO, you need a solution that can spin up a virtualised version of your server quickly - sometimes called “instant recovery” or “business continuity appliance.” The backup product and the hardware to support it need to be selected with the RTO in mind.
Realistic RTO and RPO by business type
| Business type | Typical RPO | Typical RTO |
|---|---|---|
| Medical / dental clinic | 1–4 hours | 2–4 hours |
| Law firm / accountant | 1–4 hours | 2–8 hours |
| Construction / trades | 4–24 hours | 8–24 hours |
| Retail / hospitality | 1–4 hours | 2–4 hours |
| Professional services | 4–8 hours | 4–8 hours |
These are starting points, not rules. The right numbers for your business come from a conversation about operations, not assumptions about industry norms.
The conversation to have with your IT provider
If your IT provider has never asked you about RTO and RPO, raise it with them. Specifically ask:
- “If our main server failed right now, how long would recovery take?”
- “What is the maximum data loss we'd face with our current backup frequency?”
- “Have we ever tested a full restore? What were the results?”
If they can't give you clear answers, it's a sign your backup and recovery setup hasn't been designed with your business requirements in mind.
Frequently Asked Questions
What is RTO?
RTO stands for Recovery Time Objective - the maximum amount of time your business can afford to be offline before the impact becomes unacceptable. For example, an RTO of 4 hours means you need to be back operational within 4 hours of a failure.
What is RPO?
RPO stands for Recovery Point Objective - the maximum amount of data loss your business can tolerate. An RPO of 1 hour means you need a backup taken within the last 60 minutes, so the most data you can lose is 1 hour's worth.
How do I set my RTO and RPO?
Ask two questions: 'How long can we operate without our systems?' (this gives you RTO) and 'How much data can we afford to re-enter or lose?' (this gives you RPO). The answers should come from the business owner or operations manager, not just the IT team.
Don't know your RTO or RPO?
We help Perth businesses understand their real recovery capabilities and close the gap between what they have and what they actually need. No jargon, just practical answers.
Talk to us about your recovery plan →For related reading, see our guides to How to Test Your Business Backup - A Guide for Perth Businesses and Disaster Recovery Plan for Perth Businesses.