Glossary term
Recovery Time Objective (RTO)
Subject: Risk Management, Business Continuity and Resilience
The recovery time objective is the target time within which a disrupted process, system or service must be restored after an outage, counted from the moment the disruption begins.
Explanation
Recovery time objectives turn business priorities into technical and operational requirements. They come from the business impact analysis and must sit inside the maximum tolerable period of disruption, with margin. A short RTO may need standby systems that are always running, trained staff on call and tested procedures, which cost money. A longer one can be met by restoring from backup. Setting values per system lets the organisation spend where delay hurts most. The RTO covers the whole path back to working service, including detection, decision, restoration and checks, and not only the technical restart. It is often confused with the recovery point objective, which concerns lost data. Exercises give the figure its credibility, because a target that has never been timed in a test is only a wish.
Example
A telecom operator sets an RTO of two hours for its customer billing portal and 48 hours for its reporting warehouse. In a failover exercise the portal returns in 95 minutes. The warehouse is outside the test scope, so its 48-hour target cannot be confirmed. The gap is logged and added to next year's test plan.
Not to be confused with
- Recovery Point Objective (RPO)
- RTO is about how fast service returns. RPO is about how much recent data may be lost.