In a video published by Help Net Security, Matthew Burden, CEO of BlackBox Hosting, breaks down two core disaster recovery metrics. The recovery point objective (RPO) is the maximum amount of data an organization can afford to lose, expressed as a time interval. The recovery time objective (RTO) is the longest a business can remain down before recovery must be complete.
Burden warns that a backup does not guarantee a quick recovery, and a quick recovery is of little use if the data is days old. He also stresses that each application needs its own targets, and a four-hour RTO is meaningless until it has actually been tested. He recommends testing quarterly rather than annually.
As a real-world example, Burden describes a customer with more than 1,200 virtual machines that has a contractual one-second RPO and a four-hour RTO. Data replicates between two data centers and standby hardware is kept ready. In quarterly tests, the environment starts in about 90 minutes, well within the target.
His advice is to set targets based on business needs and then test them often. The video is part of Help Net Security's ongoing coverage of backup, cloud computing, and disaster recovery strategy.