Assured Disaster Time to Recovery
Recovery Point and Recovery Time Objectives (RPO and RTO) are business defined targets related to the quantity of data and time lost in case of a disaster. RPO defines the goal related to the maximum amount of data (measured by change over time) that may be lost just prior to the disaster. RTO defines the approximate or maximum time until the data and/or systems can be accessible again in order to continue business operations. In most cases, RTO can be met and measured by the interval at which backups are taken. That is to say, if data is backed up every 15-minutes, no more than 15-minutes of data should be lost. Meeting and measuring RTO, however, is typically a much more difficult and costly endeavor.
Confirmed RTO capability is too often a guess, optimistic estimate, or possibly never even considered at all. If one of your critical business systems goes offline—due to hardware or network failure; data or file corruption; or possibly a nefarious attack—how long will your business be impacted? What is the cost in lost productivity, revenue, and potential customer impact? Unless you are periodically testing your disaster recovery (DR) plan, you cannot know the actual time it takes to recover business operations. And without knowing the potential disruption, it is impossible to calculate the risk so that you can adjust the plan and resources dedicated to DR appropriately.
Traditionally, most smaller and even mid-sized IT organizations practice their recovery plan manually, if they practice it at all. But a far better way to measure and ultimately assure recovery time is to fully automate recovery, then schedule the automated process to run at somewhat frequent intervals. The benefits of automation over a manual process include not only a measurable and predictable recovery time but also the ability to recover without requiring on hand experts in the systems to be recovered. Perhaps even more compelling is the cost savings over time. In fact, it is likely that the reason DR is not practiced more often (if at all) is that doing it manually requires significant time from expensive resources. Once the process is automated, it can be automatically practiced, validated, and measured as frequently as desired. And should