In a disaster recovery plan, what is the difference between RPO and RTO?

• A. RPO is the maximum acceptable data loss period; RTO is the time to restore operations after a disruption.
• B. RPO is the time to restore operations; RTO is the maximum data loss.
• C. RPO is the cost of downtime; RTO is the time to failover.
• D. RPO is the data retention period; RTO is the time to back up.

Answer: (A)

RPO is about how much data you’re willing to lose after a disruption. It defines the maximum age of data that can be restored, so if the RPO is four hours, you must be able to recover data up to four hours old. This drives how often you back up or replicate data.

RTO is about how quickly you must restore operations. It defines the maximum downtime you can tolerate after a disruption, so if the RTO is two hours, you need recovery processes and failover ready to bring systems back online within two hours.

These two metrics address different risks: RPO focuses on data currency and loss, while RTO focuses on how fast services are restored. To achieve a low RPO, you might use frequent or real-time data replication; to achieve a low RTO, you’d rely on fast failover, prepped disaster recovery sites, or hot standby environments.