Glossary term
Recovery Point Objective (RPO)
Subject: Risk Management, Business Continuity and Resilience
The recovery point objective is the maximum amount of data loss an organisation will accept after an outage, measured as time between the last good copy of the data and the moment of failure.
Explanation
If the RPO is one hour, backups or replication must capture data at least hourly, so no more than an hour of work is lost. A tight RPO of minutes or seconds requires continuous replication to a second site, which costs more. A looser RPO of a day can be met with nightly backups. Each system gets its own value, derived from the business impact analysis according to how costly lost transactions or records would be. The RPO is separate from the recovery time objective, which is about how long restoration takes, not how much data is missing. A system can have a short restore time and a long RPO or the other way round. A missed RPO shows up as orders or records that staff must re-key by hand, or as disputes nobody can settle from the data.
Example
An online retailer sets an RPO of 15 minutes for its order database, because re-creating more than a quarter-hour of orders by hand is not workable. It copies the database to a standby server every five minutes. After a storage failure, the team restores from the standby and finds only six minutes of orders missing, which customer service recovers from email confirmations.
Not to be confused with
- Recovery Time Objective (RTO)
- RPO looks backwards at how much data can be lost. RTO looks forwards at how long restoration may take.