What is a recovery point objective?
In a data loss situation, the Recovery Point Objective (RPO) determines how quickly you must recover from a data loss event. For example, an RPO of an hour means that data must be backed up every hour to meet the objective. When there is data loss, it must at most cause the company to lose an hour’s worth of data and no more than that. You must then set up your backups to meet this objective.
Why do I want to set a recovery point objective?
Setting a recovery point objective helps you to build your disaster recovery plan and lets you know what tolerances you are willing to establish. It is foundational to developing a disaster recovery plan because your recovery point objective sets the minimum standards for your backup. If you set a recovery point objective of an hour then you need hourly backups, which means you will need a scheme to rotate, version and retire backups that begins from that hourly basis.
How to Determine Your Recovery Point Objective
Determining your RPO can be an excellent first step in developing a disaster recovery plan. Since data loss prevention needs vary, each RPO will be unique between organizations—and even between different departments.
Before establishing your Recovery Point Objective, you should:
- Determine the highest acceptable amount of loss in any DLP situation, taking into account financial implications.
- Assess any industry-specific data resilience needs.
- Account for any and all compliance requirements and data retention policies.
Once you’ve pinpointed your requirements, they can outline the foundations of your RPO.
When setting RPOs, these intervals often serve as guidelines:
- Every 15 Minutes: Ideal for crucial operations where losing significant data isn’t an option.
- 15 minutes to 4 hours: This bracket suits departments that can tolerate losing up to four hours of data, where work can feasibly be replaced without breaking compliance regulations.
- 4 to 12 hours: Suitable for departments that are able to withstand losing a day’s work.
- 13 to 24 hours: Departments managing moderately important data fall into this category. A RPO any longer than 24 hours generally should be avoided.
How do recovery point and recovery time objectives work together?
A recovery time objective determines how fast your business desires to recover normal operations. Setting a realistic but ambitious goal here will also determine how you build your recovery plan. If you have a fairly slow moving business day you might value a slower more thorough backup system and therefore slower recovery; whereas if you work in a fast-paced industry and have a lot of business you might prioritize speed of recovery over the breadth and depth of your system. These are fairly common tradeoffs with data-oriented systems.
Best Practices for defining a recovery point objective
- Determine the needs of your business: you might be tempted to overcomplicate your process by acquiring systems above your needs, but you should be realistic about your business data and not just how quickly you can recover it but how quickly you will need it.
- Set a recovery time objective: These two concepts are closely linked. If you want to recover in an hour, you will need a fast system; if you are trying to recover a week’s worth of data, it might not be realistic to recover in an hour. These are foundational elements of your backup strategy.
- Talk to your vendors: Your disaster recovery plan should be part of your conversations with vendors when you research capabilities.
We’ve got your back(up)
Find the perfect data backup and recovery solution with our plan comparison. Kick-start your journey with a free trial.