# Turn RPO and RTO into a recovery budget you can test

> Translate acceptable data loss and interruption into a timed recovery plan, with dependencies, restore capacity and a measurable exercise.

Canonical human page: https://swissoctet.com/insights/rpo-rto-recovery-budget/

SwissOctet Editorial. Topic: operations. Level: Applied. Reading time: 4 minutes.

## Direct answer
RPO describes the data-loss window you are prepared to accept; RTO describes the interruption you aim to keep within. Define both for a useful business function, then prove the recovery sequence in an exercise. A backup schedule or a server specification alone establishes neither objective.

## Start with a service people can use
Recovery objectives become useful when they describe a business function rather than an isolated machine. A server can boot while customers still cannot sign in, retrieve files or complete a request. Write the end condition in ordinary language: authorised users can access the application and the required data is consistent. This makes the target testable by someone outside the infrastructure team.

Ask the application's owner what an interruption would prevent and what missing data would cost. A weekly publication and a transaction-processing application may have different answers. Treat the resulting objectives as planning targets, not promises invented from the hardware catalogue. Record who approved them and which failure scenarios the plan covers.

## Separate the two clocks
RPO concerns how far back the recovered data may be relative to the disruption. RTO concerns how long the function may remain unavailable. A recent backup can improve the data-loss window while a slow restore still misses the recovery-time target. Conversely, a fast reboot can restore access to an application whose newest data has not survived.

Specify the reference points. Decide when the incident clock starts, what counts as restored operation and how the usable data point will be identified. Keep the targets separate from measured results: an objective is what you seek; an exercise shows what the current process achieved. Revisit either when the application or dataset changes.

## Budget every step of the recovery
A practical RTO budget includes detection, assessment, authorisation, access to the recovery environment, restoration, application validation and reopening. The file-copy time is only one component. If the person holding the recovery key is unavailable, a theoretically fast backup can still be unusable. List the dependencies and ensure the recovery team can reach them during the failure being considered.

Assign a provisional time to each step, then replace estimates with observations. In this illustrative two-hour budget, restoration receives the largest allowance but validation still has protected time. The numbers describe a planning example, not SwissOctet service delivery. If the total has no margin, the design needs improvement before the objective is credible.

| Recovery step | Illustrative allowance | Evidence to collect |
| --- | --- | --- |
| Detect and assess | 15 minutes | Alert arrival and incident decision |
| Prepare recovery environment | 20 minutes | Access and configuration available |
| Restore data and service | 50 minutes | Completed restore with consistent data |
| Validate and reopen | 25 minutes | User journey succeeds |
| Contingency margin | 10 minutes | Unexpected work recorded |

## Check the real data-loss window
A job scheduled every hour does not automatically deliver a one-hour RPO. A failed job, delayed upload or unusable copy can make the latest recoverable point much older. Observe successful completion and the state that can actually be restored. For an application with several data stores, confirm that their recovery points are compatible rather than reading each timestamp in isolation.

Choose a reference event during an exercise, such as an authorised test record created at a known time. After restoration, identify the newest valid record and measure the gap. Use harmless test data. This gives a practical result and exposes assumptions that a dashboard showing only job success might leave hidden.

## Choose a strategy within the budget
Backup-and-restore, prepared standby environments and replicated application designs trade cost and complexity against recovery speed. Replication can reduce some delays but may also reproduce an accidental deletion or application mistake. A standby that has drifted from the working configuration creates its own risk. Select a strategy against the failure scenarios and objectives you documented.

Consider a small service with a four-hour target and a larger dataset whose restore alone takes six hours in a rehearsal. Buying a faster network port is only a hypothesis: storage reads, receiving writes and application recovery may dominate. Improve the measured limiting step, reduce the recovery set or change the strategy, then exercise again.

## Rehearse without endangering production
Use an isolated recovery environment and a defined exercise window. Make sure restored jobs cannot send real notifications, accept public payments or write into production integrations. Test access, data integrity and representative user journeys before considering the exercise complete. Include a person who did not write the original procedure to expose missing instructions.

Keep a timeline of the exercise, the recovery point achieved and every interruption caused by unavailable information. A useful report states the measured result, the gap to the objective and a specific corrective action. Repeat after meaningful changes and at an interval appropriate to the project's importance.

## Keep the plan usable during a failure
Store the recovery procedure where the team can access it without relying solely on the failed application. Keep credentials and encryption keys in a protected location with a tested access process. Update contacts, dataset sizes and dependencies as the project evolves. An obsolete plan can consume the time margin before restoration even begins.

When comparing SwissOctet configurations, separate your recovery architecture from the catalogue's optional backup choices. Confirm what an option covers, where recovery data is held and who performs restoration. The catalogue does not establish an application RPO or RTO. Your measured process and the actual service terms provide the basis for that decision.

## Checklist
- Define the restored business function.
- Approve separate RPO and RTO targets.
- Budget detection, access, restore and validation.
- Measure the latest usable data point.
- Rehearse in an isolated environment.
- Record gaps and repeat after relevant changes.

## Frequently asked questions
### Is RTO the same as uptime?
No. RTO is a recovery target for an interruption scenario. Uptime measures availability over a period; one does not establish the other.

### Does hourly backup guarantee a one-hour RPO?
No. Check completed, usable copies and the application's consistency requirements. Failed jobs and delayed transfers can widen the recoverable-data gap.

### Must every project use a standby server?
Choose a strategy against the project's recovery objectives and measured restore process. A standby adds cost and operational complexity and is not automatically necessary.

## Primary sources
- [NIST SP 800-34 Rev. 1: Contingency Planning Guide](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf)
- [AWS Well-Architected: Define recovery objectives](https://docs.aws.amazon.com/wellarchitected/2022-03-31/framework/rel_planning_for_recovery_objective_defined_recovery.html)
- [Microsoft Learn: Business continuity, high availability and disaster recovery](https://learn.microsoft.com/en-us/azure/reliability/concept-business-continuity-high-availability-disaster-recovery)

## Related infrastructure
- [Vector VPS](https://swissoctet.com/services/vector/index.txt): Your own Linux environment, with KVM virtualization and a clear path from small projects to larger workloads.
- [Vault Storage](https://swissoctet.com/services/vault/index.txt): Room for media, archives and growing datasets. A storage-focused Linux configuration.
- [Metal Atlas](https://swissoctet.com/services/metal-atlas/index.txt): Dedicated compute with more memory and storage headroom for established workloads.

## Related guides
- [Build a backup you can actually restore](https://swissoctet.com/insights/build-a-backup-you-can-restore/index.txt): Choose a recovery target, protect an independent copy and practise the restoration before an incident forces the issue.
- [A practical threat model for your hosted project](https://swissoctet.com/insights/threat-model-a-hosted-project/index.txt): Map assets and trust boundaries, choose a few realistic failure scenarios and turn them into controls you can test.
- [Secure Windows RDP administration without losing access](https://swissoctet.com/insights/secure-windows-rdp-administration/index.txt): Separate network reachability, authentication and privilege, then verify a recovery route before tightening remote access.