Recovery Time Objectives

This month's topic is Recovery Time Objectives (RTO), and how it relates to your Disaster Recovery Plan in establishing time constraints for your business critical applications.

What does Recovery Time Objective (RTO) mean exactly? We find this acronym in just about every discussion about backup products and storage arrays. Many IT people mistakenly think it refers to the time it takes to restore a system or an applications data. Although that is true, RTO and reality are sometimes not one in the same. The RTO is a goal or an ideal time in which you need a specific resource or service to be available following an interruption or outage. In essence, the RTO provides the maximum amount of time before an organization is negatively impacted by the interruption of one its core business processes or functions. For this reason, the task of establishing the RTO must start at the business level and not the systems level.

This information must be gathered from the various Business Units (BU) and then be analyzed. This analyze will help provide conclusions with respect to potential losses and the time frame from which they can be incurred. This Business Continuity Planning (BCP) process is known as a Business Impact Analysis (BIA), and should address the following items:

Business Units

Create a list of the various functions or processes for which the BU or department is responsible for revenue generating activities, and what happens when a specific business process or function is interrupted;

Possible Losses

Determine the financial or intangible losses an outage could cause. Financial losses include lost revenue, salaries paid to non-productive employees, extra expenses and fines. Intangible losses include damaged brand and reputation, negative public opinion or depreciated stocks;

Critical cycles

Consider the worst possible time at which an interruption could occur like at quarter-end or year-end in the BIA and RTO;

Dependencies

Identify applications required to perform or assist with a specific business function. Other dependencies include other business functions, services or key roles;

Prioritization of Dependencies

Identify how critical dependencies are to a particular business function. For example, unavailability of an application that is highly critical to the function may actually halt that function.

Workaround and Fixes

Create a manual process or documented contingency plan that could allow temporarily capabilities to a function, which would buy some time, thus allowing a longer RTO.

Once the potential losses have been identified, the business is in a position to make a decision regarding what it considers acceptable losses. Because losses are incurred over time, this decision also dictates the maximum outage the business can tolerate for each specific function. The RTO for the business functions must therefore not exceed that maximum tolerable outage. Subsequent dependencies identified as highly critical to these business functions, must also fall under the same RTO. It must also include the applications or other business functions and their respective applications. This is where the RTO for each application and supporting infrastructure must be prioritized and established.

So, there you have it. Recovery Time Objectives are a very critical piece of an organizations business recovery strategy. To provide reliability you should consider how you respond to procurement delays, as these elements can consume part of the RTO before the actual recovery effort is even initiated. One of the primary reasons why disaster recovery plans do so poorly, is the risk of taking shortcuts and burdening users already overloaded with other work. When a person's primary role is in conflict with their disaster recovery role, the primary role almost always wins.

To view more articles:

http://aplawrence.com/cgi-bin/getauthart.pl?Michael%20Desrosiers

or to inquire about an on-site presentation, please feel free to call me at 508-995-4933 or email me at mdesrosiers@m3ipinc.com.

Until next time.....

Regards,

Michael Desrosiers
Founder & Principal Consultant
m3ip, Inc.
Managing Your Security and Risk Needs
(O)508.995.4933
(C)774.644.0599
(F)508.995.4933
mdesrosiers@m3ipinc.com
http://www.m3ipinc.com

More Articles by Michael Desrosiers

Take Control of Maintaining Your Mac

Take Control of Syncing Data in Snow Leopard

Take Control of Upgrading to Snow Leopard

Macworld Total Snow Leopard Superguide

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.