Recovery point objective vs recovery time objective

What it means

A recovery has two separate ways to fall short: it can bring back data that is too old, or it can take too long to return the agreed service. Faster restoration does not make the same recovery point newer. Keeping the two verdicts separate tells you which tolerance was exceeded, while the objectives themselves remain targets—not evidence of achieved recovery.

Try it

Simulation: inspect the initial result, then change Allowed RPO (min) from 15 to 30. Select Compare with baseline to see the initial and current outcomes together. Notice whether the recovery-point age or restoration duration changed—not just whether the verdict changed. Editing an input clears the comparison; Reset returns to the documented baseline.

The initial example and explanation remain readable without JavaScript. Interactive controls require JavaScript, and no external action is performed.

RPO missed; RTO met. 25 min of data-age loss is compared with 15 min RPO; 40 min restoration is compared with 60 min RTO independently.

Keep Age of last usable restore point (min) at 25, Restore elapsed (min) at 40 and Allowed RTO (min) at 60. Only Allowed RPO changes.

Reset restores Age of last usable restore point to 25 minutes, Allowed RPO to 15 minutes, Restore elapsed to 40 minutes and Allowed RTO to 60 minutes. It removes input errors and clears the comparison. It does not change your independently opened or closed FAQ answers or About this model panel. There is no running clock or stored event history to reset.

How it works

The model assumes the supplied restore point is usable. It compares Age of last usable restore point with Allowed RPO, then separately compares Restore elapsed with Allowed RTO. An interval at or below its allowed maximum counts as met; an interval above it counts as missed. There is no averaging or compensation between the two comparisons.

For the simplified example, interpret recovery-point age relative to the disruption, not as the point's age after restoration finishes. The first interval describes how far back the recovered data reaches; the second describes how long the service takes to return. Adding them would mix two different questions rather than evaluate either objective.

An older recovery point can be restored quickly and still miss RPO. A recent recovery point can take too long to return the agreed service and miss RTO. The restoration duration you supply must cover the agreed recovery scope: this model does not calculate additional application or dependency recovery time for you.

Worked example

This is a synthetic baseline, not a captured recovery drill.

RPO missed; RTO met. 25 min of data-age loss is compared with 15 min RPO; 40 min restoration is compared with 60 min RTO independently.

The recovery point is 10 minutes older than the allowed data-loss interval, so RPO is missed. The service-restoration duration is 20 minutes below the allowed maximum, so RTO is met. That recovery-time margin does not offset the missed data objective.

What changes when the condition changes

Change Allowed RPO (min) from 15 to 30, keeping the recovery-point age at 25 minutes, restoration time at 40 minutes and Allowed RTO at 60 minutes.

RPO met; RTO met. 25 min of data-age loss is compared with 30 min RPO; 40 min restoration is compared with 60 min RTO independently.

The RPO verdict changes because the allowed maximum now includes the same 25-minute interval. No data became newer, and restoration did not become faster. This is a change in tolerance, not an improvement in recovery capability. It demonstrates why objectives should reflect business needs rather than be adjusted merely to make a result pass.

In practice

For a workload you are authorized to assess, begin with a read-only review of existing objectives and recovery-test records. You do not need to restore anything to compare documented intervals.

Identify three pieces of evidence for the same service and recovery event:

• The disruption reference time used for the assessment.
• The latest demonstrably usable recovery point, so its data-loss interval can be established.
• The time the agreed service capability was available again, including any application, access or dependency checks required by that scope.

The expected observation is two separately supported intervals that can be compared with their corresponding objectives. A backup-job completion time or a database-restore completion time is not automatically a substitute for those service-level observations.

STOP short of declaring an objective met if timestamps, recoverability evidence or required service checks are missing. Keep the affected result unknown and identify the missing evidence. Do not trigger a restore or overwrite live data to fill a reporting gap; an actual recovery exercise needs separate authorization, an environment-specific test plan and a rollback plan.

Limits and unknowns

These are synthetic numbers, not measured recoverability. Either objective—or both—can be missed. The Simulation performs no external action and does not inspect a machine, account, backup or service.

Use numeric values within the displayed range of 0–10,000 minutes for each field. An invalid input removes the calculated outcome until you correct it or use Reset. An empty field is not evidence of zero loss or instant restoration; do not substitute 0 when an actual interval is unknown.

For valid inputs, this model returns numerical comparisons, not an evidence-quality judgment. It has no control for missing recovery records and cannot establish whether a restore point is usable or an application is functioning. Your real-world result must remain unknown where the supporting evidence is absent, even if hypothetical inputs produce a met verdict. The data-loss interval also does not tell you how many records or bytes are missing.

What to carry forward

Treat recovery success as two evidence-backed judgments, not one score. Establish how recent the usable recovery point was and how long the agreed service took to return. If one interval is unverified, success on the other does not fill that evidence gap.