RPO, RTO, and DRaaS: Demystifying Disaster Recovery

Whether it be a natural disaster, human error, or a ransomware attack, the question is not if there will be an interruption of your business IT functions; the question is when. And by consequence, how long will it take you to put your business back online with minimum damage. An extended downtime to your IT infrastructure can be devastating. Without a proper disaster recovery plan in place, the effects on your organization range from lost revenues and business data to irreparable damage to customer trust.

As IT professionals, we face this possibility daily, and more often than not, the problem seems too complicated to solve. However, if we take a structured approach, we will most likely arrive at a workable solution within our organization’s means.

First, let’s get some jargon out of the way. When you search for disaster recovery and business continuity, you will come across questions asking you about your required RPO and RTO, but what are those? And how can I arrive at the numbers that fit my organization’s needs?

Recovery Point Objective (RPO) is the maximum period where your organization can tolerate data loss.

Recovery Time Objective (RTO) is the targeted period within which your systems should be back online.

So, the two questions you should find answers to are:

1. How much data loss can your organization tolerate?
2. How much downtime is deemed acceptable by your organization in case of disaster?

Now let’s try to break it down. To start with, it’s most likely that you don’t need all your systems replicated at 100% in real-time to have a good disaster recovery setup. On average, your applications range from mission-critical to good-to-have testing environment setup. So the first thing you need to do is to identify your mission-critical applications. Which customer-facing application, if lost, would result in unhappy customers or even a financial loss? Which systems will grind your business to a halt if they break down? Is it your e-commerce portal? Your payment gateway? Your frontdesk application?

Next, you need to figure out how long you can survive without those mission-critical applications. Can you settle for a manual process for some time? Or will your process stop completely? The goal here is to determine the maximum amount of time your organization can survive without incurring significant losses. Is it 2 hours? Then your RPO is 2 hours.

Now that you’ve figured out your RPO, it’s time for some RTO calculations. Generally speaking, you need to map out all the systems and applications that typically run in your organization’s environment and clearly identify their interdependencies. This way, you’ll know the sequence by which you will bring your systems back online. There are many ways to arrive at a number for your specific RTO. For example, you can consider your most critical application, the one that will cause the most significant loss to your organization, and use its time to recover as your baseline RTO. Another way is to take the average time of all your applications, especially if they are equally critical.

It is pretty normal to have more than one set of RPO and RTO, depending on the systems you have in your organization. In any case, the interdependency map that you come up with during normal operations should be the guideline for your systems’ disaster recovery metrics.

How can LEAN help with your disaster recovery?

LEAN Services’ Disaster Recovery as a Service (DRaaS) and Backup as a Service (BaaS) private-cloud services are based in Kuwait. And because they run in a virtualized environment and are policy-driven, you automatically remove the headache of dealing with hardware and networking issues.

LEAN Services’ DRaaS is a one-click operation that offers fast network failover and failback without the need for IP or DNS changes. Your RPOs and RTOs will be measured in minutes, not days, giving you enough assurances in your business continuity. You can also test your DR plan at will without affecting your running operations. And in case of disaster, you can rely on our 24×7 Service Management Center team to be available if and when you need us.

Finally, being a local cloud provider, we are actively connected to all the internet service providers in Kuwait. We deliver our services over highly available fast and secure data links, thus avoiding the unpredictability and the security challenges that plague the internet.

If you are in Kuwait and want to see how our services can help you, we can set up a live demo to see our solutions in real-time. We can also conduct a free assessment of your existing environment so you can optimize and find potential areas of savings.