Glossary
Recovery point objective (RPO)
A recovery point objective (RPO) is the maximum age of the data an organization accepts restoring after an outage, expressed as time. An RPO of one hour means up to an hour of recent changes may be lost. It is set per system, and what is actually achieved is the age of the newest clean copy.
How an RPO is set
NIST's contingency planning guide, SP 800-34 defines the RPO as the point in time before a disruption to which data must be recovered, and keeps it separate from downtime. The two are set independently in a business impact analysis: a payroll system may tolerate two days offline but not a single lost record, while a reporting database can lose a day of loads without harm. Setting one RPO for the whole estate either overspends on the second or underprotects the first.
Which protection method meets which RPO
The interval between copies sets the worst case, because a failure just before the next copy loses everything since the last one. Cost rises with each step down the table.
| Protection method | Data that can be lost | Typical constraint |
|---|---|---|
| Nightly backup | Up to a day | Backup window and storage growth |
| Snapshots | The interval between snapshots, minutes to hours | Snapshot count and the storage they hold |
| Asynchronous replication | Seconds to minutes, more during heavy writes | Link bandwidth and lag monitoring |
| Continuous data protection | Seconds | Journal capacity and processing |
| Synchronous replication | Nothing that was confirmed | Distance, usually one metro area |
An incremental backup copies only what changed, which is what makes hourly or more frequent backups affordable.
Stated RPO and the recovery point actually achieved
The RPO is a target. The achieved recovery point is often older, for three recurring reasons:
- Asynchronous copies fall behind during batch jobs, when the most data is being written.
- Corruption that started six hours before anyone noticed makes every copy taken since then unusable, so the usable recovery point is at least six hours old.
- Ransomware encryption replicates like any other change. A replica can show an RPO of seconds and offer nothing usable.
The real figure is the age of the newest copy that can be restored clean, which is why point-in-time recovery from locked copies sets the floor.
Frequently asked questions
What is the difference between RPO and RTO?
RPO is how much recent data can be lost, measured as time before the outage. RTO, the recovery time objective, is how long a system can be down before the harm becomes unacceptable.
Can an RPO be zero?
Only with synchronous replication, which loses nothing that was confirmed. It works only between nearby sites and does not protect against corruption or ransomware, which replicate instantly.
Who sets the RPO?
The people who run the business process, through a business impact analysis. IT then chooses the protection method that meets it.