RTO and RPO
Also known as: recovery time objective · recovery point objective
RTO is the maximum acceptable downtime after an incident; RPO is how much data you accept losing, expressed as a span of time.
These are business decisions, not technical settings. They are set by answering two questions: how long can we be down, and how far back can we roll without it being serious.
They then drive the architecture and its cost. A one-hour recovery point requires hourly backups; fifteen minutes requires replication, which costs an entirely different amount.
They only count once tested. A four-hour recovery objective never exercised is an intention, and intentions turn out to be wrong on the day of the incident.
What it means for a small business
Setting them takes an hour of discussion and avoids two symmetric mistakes: paying for continuity you do not need, or discovering during an outage that you cannot keep a promise made to a customer.
Related terms
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.