Planning for RPO and RTO

DevOpsInfrastructure
Share on LinkedIn

Disaster recovery plans love diagrams with arrows between regions. What actually matters fits on an index card: how much data can we lose (RPO) and how long can we stay down (RTO). Everything else — backup vendor, multi-cloud fantasy, runbook font — follows from those two numbers.

Definitions with teeth

RPO (Recovery Point Objective) — time-based data loss tolerance.

RTO (Recovery Time Objective) — downtime tolerance.

RPO is about data; RTO is about service. They decouple — you can have RPO 0 and RTO 2h if failover automation lags replication.

Tiering services

Tier Example Typical RPO Typical RTO
Tier 0 Payments, auth 0–1 min < 5 min
Tier 1 Core API, orders 5–15 min < 1 h
Tier 2 Analytics, CRM sync 1–24 h 4–24 h
Tier 3 Internal tools 24 h+ Best effort

Finance and product sign tiers — engineering implements and prices options.

Architecture patterns by tier

Tier 0–1:

Tier 2:

Tier 3:

Backup types and RPO

Method RPO capability
Nightly full snapshot Up to 24h
Hourly incremental ~1h
Continuous WAL/archive Minutes
Sync replication ~0 (commit on replica)

Verify backups restore — untested backup is wishful thinking. Monthly restore drill to isolated environment; measure actual RTO.

# Example: measure restore time in drill
time pg_restore -d recovery_test latest.dump
# Compare elapsed to documented RTO

Failover mechanics

Document sequence:

  1. Declare incident — who decides failover
  2. Stop writes to failed region (prevent split-brain)
  3. Promote replica / shift traffic (Route53, Global Load Balancer)
  4. Validate data integrity spot checks
  5. Communicate status — internal and external
  6. Post-incident: failback plan when primary healthy

Automate steps 2–4 where RTO demands it; human gate for declaration prevents flapping.

Split-brain and data divergence

Async replication failover with lag → lost transactions equal lag window. Accept or use sync quorum for zero RPO tiers.

Split-brain (two primaries) corrupts data — use STONITH, consensus-based leaders (etcd, Raft), or cloud-managed failover with fencing.

Cost reality

Active-active multi-region doubles infrastructure minimum. Most companies tier honestly instead of pretending everything is Tier 0.

Calculate cost of downtime vs DR spend: $lost_revenue_per_hour × expected outage probability compared to replication and drill costs.

Compliance mapping

SOC2, HIPAA, PCI often require documented RPO/RTO and annual tests. Auditors want drill logs, not slide decks.

Runbook essentials

Update runbooks when architecture changes — stale runbooks kill RTO faster than disasters.

DR tier classification

Classify systems into tiers with explicit RPO/RTO targets:

Tier RPO RTO Example systems Strategy
0 — Critical 0 <15 min Payment processing Sync replication, active-active
1 — High <1 hour <1 hour User auth, core API Async replication, warm standby
2 — Medium <4 hours <4 hours Analytics, search Daily backups, cold standby
3 — Low <24 hours <24 hours Internal tools, logs Weekly backups, rebuild from IaC

Don't assign Tier 0 to everything — cost scales exponentially. Honest tiering beats aspirational SLAs that aren't funded.

Game day exercises

DR drills prove RTO/RPO claims — schedule quarterly:

Game day script:
1. Simulate primary region failure (network partition or kill switch)
2. Execute failover runbook — timed
3. Verify application functional in DR region
4. Measure actual RTO (time to recovery)
5. Verify data loss within RPO (compare record counts)
6. Fail back to primary — timed separately
7. Document gaps between expected and actual RTO/RTO

Actual measured RTO is always longer than planned — update runbooks with real timings, not estimates.

Backup validation

Backups that aren't tested aren't backups:

# Monthly backup restore test
pg_restore -d restore_test backup_2024-12-27.dump
psql restore_test -c "SELECT COUNT(*) FROM orders WHERE created_at > NOW() - INTERVAL '1 day'"
# Compare count with production — should match within RPO window

Automate restore test monthly. Alert if restore fails or row count diverges beyond RPO tolerance.

Failure modes

Production checklist

Drill failover quarterly with timed runbooks — RTO numbers in slide decks mean nothing until someone executes restore under pressure.

Resources

Frequently asked questions

What is RPO?

Recovery Point Objective (RPO) is the maximum acceptable age of data recovered after an outage — how much data loss measured in time is tolerable. RPO of one hour means backups or replication must be at most one hour stale; zero RPO requires synchronous replication.

What is RTO?

Recovery Time Objective (RTO) is the maximum acceptable downtime before service restoration. RTO of four hours means systems must be operational within four hours of disaster declaration. Lower RTO requires hot standby, automation, and rehearsed runbooks.

How do RPO and RTO drive infrastructure decisions?

Stricter RPO/RTO costs more — synchronous multi-region replication, active-active failover, continuous backup versus daily snapshots. Tier services by business impact: payment processing gets minutes RPO/RTO; internal wiki gets days. Document tiers and test against them quarterly.

Hiring a senior Android / Flutter engineer?

I architect and ship production mobile software — Kotlin, Jetpack Compose, Flutter — for robotics, EV infrastructure, fintech, and real-time systems. Open to remote roles in Europe and the US.

Get in touch →