What Is RPO (Recovery Point Objective), and Why Is It Important?

Recovery Point Objective (RPO) is the maximum interval of time your organization expects to recover from data loss during disasters. If RPO is not met, the chances of your organization losing significant amounts of important data during downtime go up, putting your organization at risk of losing business and customer confidence. Together with Recovery Time Objective (RTO), or the maximum amount of downtime that your organization can afford before expecting major financial loss, RPO is an important, time-based metric that provides goals for your team during business continuity planning (BCP).

The Definition of Recovery Point Objective (RPO)

What is RPO?RPO is the maximum amount of time that an organization can afford to lose data after an incident. RPO is computed from the time of your last backup, or the time when you still have usable data, to the time when you are completely back up and running. In other words, its the time it will take your organization to restore data from your backups, including the time required for re-entering data into your systems. Thus, RPO covers the span of time from the start of an outage to service restoration. Consequently, the longer the RPO, the more potential for data loss.

RPO can range from near-zero to 24 hours or even longer. Large enterprises may need to maintain a near-zero RPO, particularly if they are required to do so by regulatory and other agencies. Small and medium-scale businesses that can survive for days without the need for records can afford to have longer RPOs. Near-zero or shorter RPOs are achieved through failover/failback strategies and are thus more expensive than longer RPOs that merely require backup strategies.

A Recovery Point Actual (RPA) is the actual time it takes you to recover data lost during downtime. If RPA is longer than RPO, you should strive to make it shorter or equal to your RPO.

The Calculation of RPO

When setting your RPO, consider the nature and state of your organization. For example, if you provide crucial services to customers, make sure that your RPO will minimize the impact through either continuous failover replication or frequent backups. Other companies that can afford to operate without their systems up and running for more than a day can plan for longer RPOs.

RPO is meant to ensure minimal data loss during downtime. Therefore, data retention policies and backup processes should be designed with RPO in mind. For example, if your goal is to ensure that there is minimal loss of data entered into your systems during business hours, you can set hourly or even more frequent data backups. This ensures that data loss is kept to a minimum when downtime occurs, since you must only restore data going back to the time of your last backup.

The amount of data entered into your systems is also important when computing RPO. Assuming that it takes your IT staff an hour to have you up and running again after downtime occurs, you need to consider that you have to re-enter not only the data that you lose during downtime but also the data that should have been entered into your systems while they were down. If you expect a large amount of data re-entry, you may want to rethink your RPO and set more frequent backups. If you don’t anticipate much data re-entry or can afford to live with the consequences, you can stick to a longer RPO.

RPO can also be computed per system, since backup and restoration requirements for each of your systems may be different depending on their functions. For mission-critical systems, you may have near-zero-hour backups combined with continuous or failover replication, ensuring almost 100% uptime. For other non-critical systems, backups can be less frequent.

In addition, RPO may be different depending on the time of day or the day of the week. As an example, if you do not expect systems to handle much data during early morning hours, you can schedule backups at midnight, with a repeat six hours later. You can transition to more frequent backups during office hours, especially if you anticipate data volumes to grow considerably during the daytime. For weekends, you may schedule less frequent backups, particularly if you expect lower data volumes.

The High Cost of Data Loss

Data loss can impact the operations of any organization severely, or worse, lead to severe financial loss. While the eventual impact may be different for each company, larger companies may find it easier to cope with data loss by preparing for it more extensively. On the other hand, smaller organizations may find it difficult to rebound from these potentially crippling events. In some cases, data loss can lead to companies permanently closing their operations.

Longer RPOs mean more potential for significant data loss, which in turn can lead to greater business disruption. Thus, organizations should strive for shorter RPOs. Your disaster recovery (DR) solution plays a role in achieving this goal. For example, to achieve your RPO with zero data loss, a high-availability solution with continuous data replication might be required. However, this is not always feasible considering that each company has different resource availability.

Consider RPO when setting up data backup procedures for your organization. For organizations that cannot afford to lose significant amounts of data, cloud backup and replication solutions coupled with failover/failback services are ideal. Regular production snapshots and external storage backups may suffice for other organizations with less stringent requirements.

The Role of RPO in Business Continuity

RPO is essential to effective BCP. Without a suitable RPO that allows minimal data loss, an organization does not stand a chance of making it through a disastrous event without suffering losses in both data and reputation.

Organizations must be prepared to spend more time and money to set and achieve a shorter RPO, particularly if their operations will be impacted significantly by downtime. If an organization insists on a longer RPO without looking at its potential consequences, it may save money in the short term, but it runs the risk of losing more than just data. Thus, when setting up RPO, see to it that you have set the maximum tolerable amount of data loss that you can afford, that you know the potential cost of data loss to your operations, and that you have computed the mitigation costs for downtime. Other considerations include IT staff, financial resources and company reputation.

An effective RPO makes for a more resilient business. Therefore, everyone with a stake in BCP, from C-level executives down to IT staff in charge of data backups and restoration, must contribute to coming up with a feasible and effective RPO. You should constantly assess BCP. If you are not satisfied with your RPO, you can revise it accordingly.

Data Protection Through Parallels RAS

Parallels® Remote Application Server (RAS) provides an easy way to create a virtual desktop infrastructure (VDI) for your organization. Parallels RAS provides seamless access to virtual applications and desktops from anywhere using a variety of devices and enhances your organization’s data security through centralized access management. It gives your organization the ability to scale on demand, based on dynamic workplace requirements.

Parallels RAS allows administrators to streamline deployment and backup procedures and minimize the risk of data loss using a suite of monitoring tools ideal for use in multi-cloud environments. Using highly granular permission policies, Parallels RAS secures your corporate assets using Secure Sockets Layer (SSL) and Federal Information Processing Standards (FIPS) 140-2 encryption, and multifactor and smart card authentication. These policies adhere to the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and General Data Protection Regulation (GDPR) standards. Administrators can also generate traffic and resource usage data and custom reports using the Parallels RAS monitoring and reporting service.

Get started with Parallels RAS by downloading the trial.


References

Strategic BCP

StorageCraft

Druva

Wikipedia