What is the difference between RPO and RTO ?

RTO is the time used to recovery an application, and RPO is the time from where you recover the application (time from the last snapshop or backup, for example)

In the RPO you define from when you will recover the data and in the RTO you define how many time will you use to recover it, basically.

Cheers

RTO: Recovery Time Objective

RTO refers to how much time an application can be down without causing significant damage to the business. Some applications can be down for days without significant consequences. Some high priority applications can only be down for a few seconds without incurring employee irritation, customer anger and lost business.

RTO is not simply the duration of time between loss and recovery. The objective also accounts for the steps IT must take to restore the application and its data. If IT has invested in failover services for high priority applications, then they can safely express RTO in seconds. (IT must still restore the on-premises environment. But since the application is processing in the cloud, IT can take the time it needs.)

Your RTO mission is to categorize applications by priority and potential business loss and match your resources accordingly. For example, typical plans for near-zero RTOs will require failover services. 4-hour RTOs allow for on-premises recovery starting with bare metal restore and ending with full application and data availability. For 8+ hour RTOs, IT may sign maintenance contracts with local system integrators.

RPO: Recovery Point Objective

Recovery point objectives refer to your company’s loss tolerance: the amount of data that can be lost before significant harm to the business occurs. The objective is expressed as a time measurement from the loss event to the most recent preceding backup.

If you back up all or most of your data in regularly scheduled 24-hour increments, then in the worst-case scenario you will lose 24 hours’ worth of data. For some applications this is acceptable. For others it is absolutely not.

RTO and RPO is used for planning availability and Disaster recovery of an application or Infrastructure. RPO is the recovery point objective, meaning to the point or state the application or database will be recovered. For eg 1hr RPO for a database means that in case of disaster when Database will be recovered it will lose a maximum of 1 hour transactions not more. RTO stands for recovery time objective meaning the total time required to recover an application or Infrastructure in case of a disaster

Recovery Point Objective (RPO) defines the criticality of the data and determines how much data your business can acceptably lose if a failure occurs. The more critical the data, the lower the RPO.

Recovery Time Objective (RTO) is the estimated repair time and determines the acceptable amount of time needed for recovery. 

So, what does RTO mean? BS 25999-2, a leading business continuity standard, defines RTO as “…target time set for resumption of product, service or activity delivery after an incident”.

This actually means that RTO is crucial when implementing business continuity in a company – calculating how quickly you need to recover will determine what kind of preparations are necessary. For example, if RTO is 2 hours, then you need to invest quite a lot of money in a disaster recovery center, telecommunications, automated systems, etc. – because you want to be able to achieve full recovery in only 2 hours. However, if your RTO is 2 weeks, then the required investment will be much lower because you will have enough time to acquire resources after an incident has occurred.

Recovery point objective is a totally different thing – according to Wikipedia, RPO is “… the maximum tolerable period in which data might be lost”. As this is quite difficult to grasp right away, I like to use this example instead – ask yourself how much data you can afford to lose? If you are filling in a database with various kinds of information, is it tolerable to lose 1 hour of work, 2 hours or maybe 2 days? If you are writing a lengthy document, can you afford to lose 4 hours of your work, the whole day or perhaps you could bear if you lost your whole week’s job?

This number of hours or days is the RPO. Recovery Point Objective is crucial for determining one element of business continuity strategy – the frequency of backup. If your RPO is 4 hours, then you need to perform backup at least every 4 hours; every 24 hours would put you in a big danger, but if you do it every 1 hour, it might cost you too much.

rpo -recovery point objective...the maximum period "that's accepted" by system/application BC governance involving the loss of data from an severe incident

rto -recovery time objective...ideally, the time it takes from initial statement of declaring a disaster to full system/application restoration for "full use and availabily"

Main two points of recovery, RPO is recovery point objective and RTO is recovery time objective..

The main difference is in the purpose behind the two. RTO places a time frame on viable strategic options that enable an organization to resume business without the use of data, while RPO is a measurement of the amount of time that data can be permitted to be lost, and is not a measure of how much data might be lost.

RPO & RTO are related to business continuity.

RPO is Recovery Point Objective, that is the amount of data loss in terms of time that a business can risk loosing in case of a disaster.

RTO is Recovery time objective, that is the time agreed for a service to be operational following a Incident/disaster.