peshkova - Fotolia
The recovery time objective metric is one of the outcomes of a business impact analysis. As such, recovery time...
objectives should be periodically reviewed to ensure the metric is appropriate for the business process and its associated technology and personnel requirements.
This review of recovery time objectives should be conducted with the process owner, who makes the decision regarding RTO value. Achieving the RTO is then a matter of configuring technology, operational procedures and employees.
The idea of improving an RTO can be interpreted in different ways. It can depend on the business requirements, addition and deletion of systems, business impact analysis results, risk assessment results, disaster recovery test results, business continuity plan exercise results and other criteria.
Most organizations are happy just to meet their RTOs. However, making a change in an RTO value should be followed up with a test to see if the new value can be achieved. Rarely does this happen in practice. Most IT organizations are simply too busy to conduct multiple DR tests. As a result, once an RTO is established, there must be a compelling business reason to change it.
Tips for improving your RTO
Advances in technology have made it easier for organizations to achieve recovery time objectives. For example, backing up critical systems and their associated data and databases once a day can probably support an eight-hour RTO. However, if a two-hour RTO is required, techniques such as data replication and mirroring can be used to generate more frequent backups. The fact that the systems are backed up more frequently ensures there will be greater confidence that the systems can be recovered and brought into production when needed. This approach assumes the organization can justify the added cost for the more powerful backup technologies.
It's also necessary to define what it means by improving recovery time objectives. Increasing the amount of time from a previous value, such as from eight hours to 24 hours, could be interpreted as improving the RTO. By contrast, decreasing the amount of time for recovery, for example, from eight hours to two hours, can also be considered an improvement. Again, this must be carefully reviewed with the process owner.
Perhaps the best way to see if recovery time objectives can be improved is through the results of a DR plan test. For example, if an original RTO was for four hours, and during the test the recovery took less than two hours, the RTO could be adjusted to two hours.
An easy way to improve an RTO, therefore, is to review the value with the process owner and see if a change can be made. As an example, change a four-hour RTO to a two-hour RTO. See if such a change requires any modifications to technology or staffing that may save money. But make no changes to recovery time objectives without the approval of the process owner.
Recovery time objective is key to selecting DR approach
Download a free business impact analysis template
Vendors respond to faster recovery time demands
Dig Deeper on Disaster recovery planning - management
Related Q&A from Paul Kirvan
A strong data protection strategy must follow applicable standards and regulations to protect data and comply with privacy laws. What are some key ... Continue Reading
A major element in maintaining business continuity during a pandemic is taking care of employee health. Pandemic-specific planning must be a part of ... Continue Reading
This backup and recovery audit checklist offers a comprehensive group of controls and evidence examples to get you ready for the important process of... Continue Reading