RPO and RTO: what these terms mean and why they matter for your business

RPO and RTO are among the first terms you hear in any serious conversation about backup and disaster recovery. But in practice, few SME managers know what they actually mean or how to calculate them for their own company. Without these two values, you can't judge whether your backup system is really fit for purpose — or whether it will protect you when it counts.

What RPO (Recovery Point Objective) is — how much data loss can you afford?

The Recovery Point Objective is the maximum amount of data you're prepared to lose in an incident — expressed in time. If your backup runs every night at 02:00 and a ransomware attack hits at 17:00, you've lost 15 hours of data. That's your real RPO, even if you've never defined it explicitly.

A large RPO (e.g. 24 hours) means you accept losing a whole day of data. A small RPO (e.g. 1 hour or 4 hours) means backups run more often and the maximum loss is limited to that period.

Concrete examples of why it matters:

• An accounting firm at year-end: data entered on a busy working day can't be recreated from memory. A 24h RPO is catastrophic — you've lost a whole day's work for the entire team.
• An online shop with real-time orders: orders placed in the last few hours are lost for good if the RPO is 24h. An RPO of 1–4h is far more acceptable.
• An administrative office with documents edited occasionally: it can tolerate a 24h RPO if the data is relatively static during the day.

What RTO (Recovery Time Objective) is — how long can you be offline?

The Recovery Time Objective is the maximum acceptable time from the moment of the incident until your company is back to normal operation. It's not just about restoring the backup — it includes investigating the incident, reinstalling systems, testing that everything works and resuming work.

RTO and RPO are different and influence each other. You can have an excellent RPO (hourly backup) but a poor RTO (the restore takes 3 days) — and vice versa.

A few examples relevant to common types of businesses:

• A medical clinic: the RTO has to be a few hours at most — patients arrive, appointments can't be cancelled, records have to be accessible.
• A notary office with court deadlines: a notarial deed with a fixed deadline can't be postponed. An RTO of 4–8 hours at most on critical days.
• An accounting firm in a normal period: it can tolerate an RTO of 24–48h without significant financial impact.
• A transport company with a dispatch centre: every hour of downtime means idle vehicles and missed contracts. An RTO under 2 hours.

Why RPO and RTO determine which backup system you need

Without knowing these values, every backup decision is a guess. Many business owners buy a backup solution based on price or on someone's recommendation — without checking whether it meets their company's real RPO and RTO.

How these values relate to the infrastructure you need:

• Small RPO (1–4h) → more frequent backup: automatic snapshots every 1–4 hours, not a daily backup. It requires a local NAS with enough space for multiple versions.
• Small RTO (under 4h) → fast local restore: a cloud-only backup isn't enough. Downloading 500GB takes hours. You need a local copy that's available immediately.
• Large RPO + large RTO: a daily cloud backup may be enough — suitable for companies with less critical activity.
• Small RPO + small RTO: the full 3-2-1 architecture — a local NAS with frequent snapshots + encrypted offsite cloud. This is the standard we implement for clients with demanding requirements.

How to set RPO and RTO for your business — 4 key questions

You don't need an enterprise consultant for this. Answer these 4 questions honestly and you'll have your baseline values:

1. How many hours or days of data could you recreate by hand if you lost it completely — from emails, notes, calls with clients? That's the upper limit of an acceptable RPO.
2. How many hours without access to data would mean significant financial losses or contractual penalties? That's the upper limit of an acceptable RTO.
3. Which periods of the year are critical, when RPO and RTO need to be lower? (year-end, busy season, tax deadlines, a project with a deadline)
4. Do you have contracts or legal obligations that require a response time or data availability? (GDPR Art. 32, client SLAs)

Write the answers down. They become the basis of your business continuity document — and an objective criterion for evaluating any backup solution.

Typical RPO and RTO values for SMEs

How we meet RPO and RTO with our solutions

Every BackupFirma implementation starts by explicitly defining the RPO and RTO for each client. We don't deploy a generic solution — we size the snapshot frequency, local capacity and upload bandwidth to the agreed values.

• A local Synology NAS with immutable snapshots every 4h → 4h RPO, full protection against ransomware
• Hourly snapshots for critical data (DSM 7.x with Btrfs) → 1h RPO for essential folders
• Restore from a local snapshot → 30–60 minute RTO for full recovery
• Daily cloud backup on Wasabi (AES-256 encrypted) → 24h RPO for archives and the offsite copy
• Restore from the cloud → 4–8h RTO depending on volume — suitable as a fallback, not as the primary solution

We document the target and actual RPO and RTO for each client in the continuity plan included in the Business and Professional packages.