Business Continuity Essentials: RTO, RPO and More PDF Free Download
1 / 5
/5
100%
Business Continuity Essentials: RTO, RPO and More
2msp360.com
At rst glance, business continuity may seem like a simple term that refers to the practice of keeping a business
running during unexpected events.
But once you dive into business continuity, you realize that it is informed by a variety of distinct concepts and
practices. Understanding each of them is critical for formulating a business continuity plan that achieves the
intended results, no matter which types of disruption a business faces. Equally important is recognizing the
dierences between business continuity and related concepts, such as disaster recovery.
Defining Business Continuity
Business continuity refers to the discipline of ensuring that a business can continue operating in the face
of unexpected events.
Those events could be man-made (such as a political disruption or economic crash) or they could be a natural
disaster (such as a re or an earthquake). The events could be small-scale and localized (such as the loss of
power to one data center) or they could aect a large area.
The length of time that the disruption lasts can vary, too. Business continuity planning applies equally to
disruptions lasting only a few hours as to those that remain ongoing for months.
There are three main components to business continuity:
ʼnResilience: The practice of designing systems to be as resilient as possible in the face of disruptions.
ʼnRecovery: The process of relocating, restoring, rebuilding or reproducing business systems or data that
are disrupted in the event that, despite attempts to design resilient systems, those systems fail.
ʼnContingency planning: The implementation of procedures to follow in the event that business systems
cannot be recovered as originally planned.
Business Continuity vs. Disaster Recovery
Business continuity is related to, but is distinct from, disaster recovery.
Business continuity and disaster recovery both involve helping a business recover from unexpected disruptions.
Both concepts are often integrated into a single business continuity / disaster recovery (BCDR) plan.
However, disaster recovery is limited only to the process of actually recovering or restoring systems or data
following a disruption. In contrast, business continuity is a broader set of practices that (as noted above) also
involves designing for resilience and planning for contingencies.
Business Continuity vs. Disaster Recovery Testing
Another concept that informs business continuity, but is distinct from it, is disaster recovery testing.
The latter term refers to the practice of testing disaster recovery plans to ensure that they can actually be
followed as expected. Disaster recovery testing can take several forms varying in depth, ranging from simply
Business Continuity Essentials: RTO, RPO and More
3msp360.com
reading through the plan and assessing whether each step appears feasible, to performing live tests by
deliberately disrupting a system and following the plan to recover it.
Business Continuity vs. Business Continuity Planning
A distinction can be drawn, too, between business continuity and business continuity planning.
Business continuity planning is the process of designing and testing plans that IT teams will follow in order to
maintain business continuity in response to a disruption. Business continuity plans often address dierent
categories of disruption and specify how to react to each one. They also identify the roles that individuals and
teams will play in ensuring business continuity, and the resources they will need in order to perform their roles.
But there is more to business continuity than just planning. As noted above, designing systems to be resilient
from the start is an additional aspect. So is designing and implementing recovery tools that are exible enough
to achieve recovery goals even if the business continuity plan goes awry.
Measurable Metrics
To a degree, business continuity is a qualitative exercise that requires careful assessment and evaluation.
But eective business planning also relies on quantitative data.
RTO and RPO
Above all, it should be tailored to metrics known as Recovery Time Objective (RTO) and Recovery Point
Objective (RPO).
These terms mean the following:
ʼnRTO: The amount of time that a business can keep operating without its normal data and systems
restored. For example, if a business’s RTO is twenty-four hours, the business can remain viable if its IT
systems are down for up to that length of time.
ʼnRPO: The amount of data (measured in length of time) that a business can aord to lose without a critical
disruption to its operations. For example, RPO could specify that a business can lose up to eight hours’
worth of data.
RTO and RPO requirements are dierent for each business. Business continuity planning should start with the
identication of RTO and RPO needs, and business continuity plans and resources should be tailored to meet
them.
In addition, since RTO and RPO requirements can change as businesses evolve, it’s important to reevaluate them
on a periodic basis -- once every three or six months, at minimum -- to determine whether business continuity
plans still align with these metrics.
Business Continuity Essentials: RTO, RPO and More
4msp360.com
Cost of Downtime
A second type of metric to consider for business continuity is the cost of downtime, which refers to the amount
of money a business will lose for each minute or hour that it is not operating as usual due to an IT failure.
The cost of downtime is aected by a range of factors, such as how much revenue the business normally
generates, regulatory nes that it may have to pay due to downtime, and loss of reputation caused by
downtime. Obviously, although the average cost of downtime is $5,600 per minute, downtime costs vary widely
from one business to the next. Businesses with high revenues or strict compliance requirements will face higher
downtime costs, for example.
Calculating a business’s exact cost of downtime before a disruption is impossible; the best you can do is
estimate. Still, having a baseline estimate of the cost of downtime is important because it helps IT teams to
determine just how essential a fast recovery may be. Even if a business continuity plan meets RTO and RPO
goals, it may be desirable to make the plan more aggressive, so that recovery is completed faster and the cost of
downtime is minimal, if the business is subject to characteristics that cause a high downtime cost.
Conclusion
In IT, as elsewhere, you can expect the unexpected to happen -- although you can’t know when disruptions will
occur, what form they will take or how long they will last.
That’s why it’s essential to devise a holistic business continuity strategy that is informed by a variety of dierent
considerations -- disaster recovery resources, metrics like RPO and RTO, disaster recovery testing and more
-- in order to maximize your team’s chances of providing the IT resources that a business needs in order to get
through a disruption.
About MSP360™
Established in 2011 by a group of experienced IT professionals, MSP360™ (formerly CloudBerry Lab) provides
cloud-based backup and le management sevices to SMBs.
MSP360’s oerings include powerful, easy-to-use backup management capabilities and military-grade
encryption using customer-controlled keys.
Business Continuity Essentials: RTO, RPO and More
5msp360.com
Customers can choose to store their backup data with all the major cloud storage providers, including Amazon
S3, Microsoft Azure, Google Cloud, Wasabi, and others. MSP360™ also partners with thousands of VARs and
MSPs to provide them with turnkey, white-label data protection services.
