The recovery time objective (RTO) is the amount of time required to restore business systems after an interruption, as determined by previous experience, system parameters, and estimates made by people involved in the maintenance and repair. Businesses consider the recovery time objective to be the maximum amount of time the system can reasonably be down in an emergency. In actuality, when systems go down, it is not uncommon for them to exceed this limit, and the circumstances of individual situations are used as learning experiences to avoid repeating problems in the future.
This figure can be based on a number of factors including known limitations of the system, average repair times, and other issues that may be involved in the process of restoring a business to full operational status. The goal is to reach the recovery point objective, a restoration point determined by looking at where the business was before a problem developed. Setting clear guidelines for system restoration is important for quickly and actively responding to crises, in addition to gauging the efficiency and effectiveness of the framework used to recover the system.
Businesses lose money when their systems are not operating. Most have a small buffer built in to provide continuity while their systems are not fully operational, such as manually recording credit card information for sales so they can stay open during a power outage. If this is exceeded because the recovery time objective is not met, the business can start taking losses and a ripple effect may be created.
Service providers work with businesses to provide an accurate recovery time objective and develop action plans for ensuring that recovery goes quickly and smoothly. Electric utilities, computer services companies, and similar entities are involved in recovery from problems ranging from power outages caused by poor weather conditions to damage to computer systems as a result of a hacking. Action plans present a number of alternatives for contingencies, so businesses have plans in place for recovery before a problem develops.
After a business has recovered from the problem, a meeting may be held to discuss how the situation was handled and to identify areas where there is room for improvement. If the recovery time objective was not met during the process, businesses want to know why so they can see if it is necessary to adjust their recovery plans or make other changes. This can be especially important when businesses must provide compensation for system failures, as companies want to avoid unnecessary payouts to customers.