Disaster Recovery Planning: RTO, RPO, and What It Costs
Key takeaway
Set RTO (how long you can be down) and RPO (how much data you can lose) per system before choosing a strategy — they determine cost more than any technology decision. Then test the restore on a schedule; backups that have never been restored are assumptions, not protection.
Disaster recovery conversations stall because they start with technology. They go quickly when they start with two numbers per system, agreed by the business rather than by engineering.
The two numbers
Both are business decisions with a price tag. An RTO of 24 hours is cheap; an RTO of 15 minutes costs an order of magnitude more. Setting them per system — rather than one heroic target for everything — is what keeps the programme affordable.
- RTO — Recovery Time Objective: how long the system can be unavailable before the damage is unacceptable.
- RPO — Recovery Point Objective: how much recent data you can afford to lose, measured in time.
The four strategies, cheapest first
- Backup and restore — backups in another region, infrastructure rebuilt on demand. RTO in hours to days. Lowest cost.
- Pilot light — core data replicated and minimal infrastructure always running; scale up on failover. RTO in tens of minutes.
- Warm standby — a scaled-down but running copy of the full environment. RTO in minutes.
- Active/active — full capacity in two regions serving traffic. Near-zero RTO, roughly double the infrastructure cost, and the most demanding to operate.
What people forget to include
- DNS and TLS certificates — a perfect standby environment nobody can route to is not recovery.
- Secrets, configuration, and CI/CD — replicate the ability to deploy, not just the data.
- Third-party dependencies that may be in the same failed region as you.
- The runbook itself, stored somewhere that survives the outage, and readable by whoever is actually on call.
Test it, or it isn't real
Run a restore from backup at least quarterly and time it against your stated RTO. Run a full failover exercise annually. Nearly every organisation that discovers a broken backup discovers it during a real incident — the cost difference between finding it in a drill and finding it in a crisis is the entire point of the exercise.