RPO & RTO
Turn disaster recovery into explicit data-loss and restoration objectives.
2–5 minute refresher
Timeout→Backoff→Jitter→Retry budget→Circuit breaker→Load shedding
RPO asks how much state may be lost; RTO asks how long service may be impaired
30second
refresher
refresher
Recovery Point Objective bounds acceptable data loss measured backward from an incident. Recovery Time Objective targets how quickly an acceptable service level is restored. Both must be defined per capability and failure class.
What problem does it solve?
Teams often buy replication and backups without agreeing on the business outcome during disaster. Objectives connect technical recovery mechanisms to tolerable customer impact.
How it works
- Identify business capabilities and protected invariants.
- Define the disasters included in the objective.
- Set RPO from acceptable lost or replayed business events.
- Set RTO for a clearly described degraded or full service state.
- Build, rehearse, time, and audit the recovery path end to end.
Decision guide
Key trade-offs
| Choice | What you gain | What it costs |
|---|---|---|
| Lower RPO | Less data loss | More synchronous durability and cost |
| Lower RTO | Faster restoration | Warm capacity and automation |
| Tiered objectives | Spend according to business value | More explicit product states |
What happens if?
The backup exists but restoration takes two days
The storage objective may be met while the service RTO fails. Recovery includes credentials, infrastructure, metadata, dependencies, validation, traffic routing, and operator decisions—not only data download.
Where it appears
- Disaster recovery plans
- Backup policies
- Regional failover
- Business continuity exercises
Senior interview modeCan replication replace backups?Show answer
No. Replication improves availability but can copy deletion, corruption, or operator error. Backups provide historical recovery points; both need tested restore procedures.