What Are RTO and RPO? Setting Your Disaster Recovery Targets

When you ask an SME owner "do you have backups?", the answer is usually a quick "yes." But "in a disaster, how much data can you afford to lose and how quickly must you be back up?" goes unanswered. RTO and RPO are the answers to those two questions and they form the heart of a disaster-recovery plan. Set incorrectly, you either spend money on technology you do not need or arrive too late at a critical moment.

What Is RPO?

RPO (Recovery Point Objective) expresses the maximum acceptable data loss in a disaster. It answers "to which most recent backup can we roll back?" — and it is a time value.

A practical example: with an RPO of 4 hours, the data lost in a disk failure at 09:00 is at most the last 4 hours of activity. You would roll back to a 05:00 backup. With an RPO of 24 hours, you roll back to the midnight backup and lose 9 hours of data.

RPO directly drives backup frequency. RPO 1 hour → hourly backups; RPO 4 hours → every 4 hours; RPO 24 hours → a single daily backup is enough. A low RPO need (frequent backups) increases cost.

What Is RTO?

RTO (Recovery Time Objective) expresses how quickly a system or service must be brought back online after a disaster. It answers "how fast must we be back to normal?"

RTO is the total acceptable downtime; it is a different axis from "do we have backups." You may have a backup, but if it takes 6 hours to restore, your RTO is at least 6 hours. If business continuity requires being up within 1 hour, then you need 1-hour-RTO technology (hot standby, replication, high availability).

Confusing RPO and RTO

The two concepts are often confused. The practical difference:

• RPO = "How much data is lost?" → determines backup frequency
• RTO = "How fast do we come back up?" → determines restore speed/technology

Think of a restaurant: the POS dies on Friday at 13:00. With RPO 24 hours, you roll back to the previous night's (Thursday 23:00) backup and manually re-enter all morning sales. With RTO 2 hours, the system must be running by 15:00; the cashier will key in the 14 hours of data afterward. RPO and RTO are two independent numbers — one asks "how much do you lose," the other "how long do you wait."

Typical RTO/RPO Ranges in SMEs

At SME scale, the typical acceptable ranges we have observed for systems in the field:

These numbers are a starting point; every SME can dial them lower or higher based on its business reality. An e-commerce business issuing high invoice volumes can drop ERP RPO to 30 minutes; a small service office may be fine with 24 hours.

How to Set RTO and RPO — A 5-Step Method

Finding the right number is an analysis exercise. A simple method that works in an SME environment:

1. Business Impact Analysis (BIA): What does each system's downtime mean for the business? Hourly revenue loss, broken customer communication, delayed legal obligations. For an e-commerce business with TRY 5M annual revenue, an hour of downtime is about TRY 600 of lost revenue + customer loss + reputational damage.
2. Criticality classification: Group systems as "critical / important / standard / low." Critical systems demand the tightest RTO/RPO; low ones can live with 24-48 hours.
3. Set targets: Assign RPO and RTO for each group. Agree with the leadership — the numbers affect the budget.
4. Technology selection: RPO 1 hour → hourly snapshots; RTO 1 hour → hot standby/replication; RPO 24 hours → daily backups are enough.
5. Test and revise: Are the chosen RTO/RPO actually being met? Test every 6 months and update the numbers.

RTO/RPO and Cost

Low RTO and RPO require high cost. The typical cost curve:

• RPO 24h / RTO 24h: Daily backup + manual restore. Monthly backup cost TRY 100-300.
• RPO 4h / RTO 4h: 4-hour incremental + cloud backup + bare-metal restore. Monthly TRY 300-800.
• RPO 1h / RTO 1h: Continuous replication + standby server + automatic failover. Monthly TRY 1,500-5,000.
• RPO 0 min / RTO 0 min: Active-active cluster + multi-site data centers. Monthly TRY 10,000+ and specialized expertise.

The ideal SME balance is usually around RPO 4h / RTO 4h. Demanding "zero loss / zero downtime" means dramatic cost increase; does the business really require it, or is it just the manager's anxiety? When that distinction is clear, the decision becomes easy.

Common Mistakes

• Picking technology before setting RTO/RPO: Saying "let's buy Veeam" is choosing a tool before deciding what it should meet. Targets first, tools second.
• Applying the same RTO/RPO to every system: Email and the archive folder are not equally important; give each its own target.
• Assuming "our target is being met" without testing: Promising an RTO without running a restore drill every 6 months is hope, not policy.
• Leaving senior management out of the loop: The numbers affect the budget; without owner/CEO approval, either the budget gets blocked or you get blamed for being short in a crisis.
• RTO/RPO on paper, the backup not even working in reality: The target is documented, monitoring is not set up, and no one knows when a backup fails. Automated notifications and monthly verification are essential.

Frequently Asked Questions