Recovery Time and Point Objectives

IC_BL-DR-3_Mod1 Pre-reading [BL-DR-5] [M1-S1] This is the introduction of concept relating to the recovery objectives when commencing a IT DR Project. It is essentail for participants to understand the RTO and RPO concepts as this served as the foundation for the identification of the criticality of application system.

Develop Recovery Priorities

The outage impact(s) and allowable outage times identified enables the Organization DR Coordinator to develop and prioritize recovery strategies, that is, the sequence for recovering critical IT functions when the DR Plan is activated.

For example, if the impact outage analysis determines that the system must be recovered within four hours, the Organization DR Coordinator need to adopt measures to address that need.

Similarly, if most system components can tolerate a 24-hour outage, but a critical component can only tolerate eight hours, the Organization DR Coordinator will prioritize the necessary resources to recover the critical components first. By prioritizing these recovery strategies, the Organization DR Coordinator may make more informed, tailored decisions regarding DR resource allocations and expenditures, saving time, effort, and costs.

Recovery Objectives

One of the most important elements in DR Planning process is the understanding the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for various businesses IT functions. The recovery objectives provide the foundation for the entire DR Planning process and it serves as a basis for BIA.

Recovery Point and Time Objectives

Recovery Point Objective

Recovery Point Objective (RPO) refers to the point in time at which data must be restored in order to resume processing of critical business transactions.

For example, if your RPO is 6 hours, you want to be able to restore the systems back to the state they were in, as at 6 hours ago. One of the strategies to achieve this requirement will be to create backups or other data copies every 6 hours. Any data created or modified inside your RPO window, that is, after the last backup, will be lost and must be recreated during a recovery. If your RPO is that no data is lost, online synchronous remote copy solutions may be the only choice.

Recovery Time Objective

Recovery Time Objective (RTO) refers to the minimum acceptable time period within which critical business functions shall be restored and made available to continue critical business operations in the organization.

In other words, if the time taken to restore a resource is beyond its RTO value, it will adversely impact the organization. And the longer the RTO, the lower will be the cost for recovery.

For example, you might determine that customer service must be functioning again after an interruption of one (1) day. The RTO is one (1) day. You might decide, on the other hand, that the RTO for your email system is four (4) hours. In some Internet businesses, an RTO might be measured in minutes.

You have to ascertain how quickly you require a particular IT application or system to be made available again. Otherwise, you cannot build a DR Plan that meets these critical recovery milestones. For example, the most critical IT needs for a financial institution are in its dealing room, as it can lose millions in just a few minutes should the IT facilities fail. Therefore, the recovery time for the dealing room IT facilities should be as short as possible.

Alternatively, other functions (marketing perhaps), while important to the organization’s overall strategy, is not critical during a DR. In fact, it may be possible to function adequately without your marketing business unit for hours or even days. A good understanding of your business operations’ RTOs enables you to devise a plan to ensure a timely and effective business restoration.

It is important to highlight that the results of the BIA enable the Organization DR Coordinator to determine the RPO and RTO for the recovery of mission-critical IT systems and applications. The RPO and RTO serve as reality checks for DR Planning; for it reminds you to focus on the essentials of recovery. For example, you may be able to recover successfully with only 30 percent of staff rather than your entire workforce; or cope with data that is 24 hours, rather than 24 seconds, old; or from a shared rather than dedicated recovery facility. Or perhaps will you need the instantaneous fail-over synonymous with high availability

Recovery Point versus Cost

Whatever your requirement, the BIA will determine the relevant RPO for each application or function and from this you can ascertain how each part of the business would be recovered in case of an interruption, thereby developing a DR Plan tailored to the myriad of recovery needs of your business.

Reference

Goh, M. H. (2016). A Manager's Guide to Implementing Your IT Disaster Recovery Plan. Business Continuity Management Specialist Series (2nd ed.). Singapore: GMH Pte Ltd.

Extracted from "Chapter 4: Project Management: Step 1: Establish the Need for DR Planning"

More Information About IT DR Blended Learning

To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org. They are the BL-DR-3 Blended Learning DR-300 IT Disaster Recovery Implementer and the BL-DR-5 Blended Learning DR-5000 IT Disaster Recovery Expert Implementer.