What is a disaster recovery objective (RPO/RTO), and how do they guide planning?

• A. RPO is minimum tolerable data loss; RTO is maximum downtime
• B. RPO is maximum tolerable data loss; RTO is maximum allowable downtime
• C. RPO is time to restore service after an incident; RTO is data backup frequency
• D. RPO and RTO are unrelated to disaster recovery planning

Answer: (B)

Disaster recovery objectives tell you how much data you can afford to lose and how quickly you must have services back online, and they shape every planning decision. Recovery Point Objective defines the maximum amount of data the business is willing to lose, expressed as a time window. If the RPO is 4 hours, you can tolerate losing up to 4 hours of transactions, so backup or replication must occur at least that often—more frequent for a tighter RPO. Recovery Time Objective is the maximum downtime the organization can tolerate after a disruption. An RTO of 2 hours means you must restore and bring services back within two hours, which drives the need for rapid recovery mechanisms, such as automated failover to a hot or warm site.

These targets guide planning by helping you categorize systems by criticality, pick appropriate disaster recovery strategies (continuous replication, rapid failover, cloud DR, or periodic backups), determine required resources, craft recovery runbooks, and schedule testing. Different applications can have different RPOs and RTOs based on their importance to the business, ensuring the plan aligns with actual risk and acceptable impact.