The Two Numbers That Decide If Your Business Survives a Bad Day: RTO vs. RPO Explained

Nobody notices until the first person tries to log in at 8. Two questions decide what happens next, and almost no business has calculated the answer to either one before that morning arrives.

How long can the business survive without that system. That's RTO, recovery time objective. And how much data can it afford to lose forever, the gap between the last good backup and the moment everything stopped. That's RPO, recovery point objective.

Most businesses have backup software running. Almost none have an actual number for either question. Not a guess. Not "pretty fast, probably." An actual, tested number, the kind you'd be willing to say out loud to a client, an insurer, or your own leadership team.

Here's the uncomfortable part. A backup that has never been tested against those two numbers isn't a recovery plan. It's a file sitting somewhere that everyone is hoping will work when it matters. It's also one line on a short list of things worth checking before you'd honestly say your business is protected from a cyberattack.

This is also exactly the kind of question a cyber insurance application asks, directly or indirectly, and exactly the kind of question that gets asked in the room after an incident, when the answer is worth a lot more than it was the day before. If you don't know your own RTO and RPO right now, that's not a confession, it's the most common answer there is.

You don't need a formal assessment to get a first estimate. Ask whoever manages your IT two questions: when was the backup restore last actually tested, not just scheduled, and what did that test show for how long recovery took? If nobody can answer with a specific date and a specific number, that's the real answer. It means the honest current RTO and RPO for your business is "unknown," which is worse than a bad number, because a bad number can at least be improved on purpose.