After reading, you can set an RPO for each data set and translate it into a backup frequency you can verify.
Definition
ISO 22301 defines it as the point to which information used by an activity must be restored for the activity to operate on resumption. An RPO of one hour means losing at most the last hour of data.
Why it matters
It decides how often data must be copied: nightly backups cannot meet an RPO of 15 minutes.
The right target depends on what can be rebuilt. Some lost data can be re-entered from paper or from a partner's system, and some is simply gone.
How it works
Ask the business owner what would be lost and how it could be rebuilt. Set the RPO for each data set, since a single figure for the company will be wrong for most of them.
Choose the means: daily or hourly backups, log shipping, or synchronous replication. The interval must be no longer than the RPO.
Test a restore and look at the date of the last transaction you got back. That date is your real RPO.
A worked case
A clinic's appointments can be rebuilt from text message records, so 4 hours is acceptable. Its patient notes cannot be rebuilt, so the RPO is 15 minutes, met through log shipping to a second site.
A test restores the notes up to 11 minutes before the simulated failure, and the test report records that figure.
Good practices
- Keep older copies as well, in case corruption goes unnoticed for days.
- Monitor that backups actually finish, and read the failures.
- Check what each SaaS provider retains, and for how long.
Common mistakes
- Assuming that a backup which ran is a backup which restores.
- Asking for an RPO of zero everywhere, without pricing it.
- Forgetting data held in SaaS services, because nobody in IT ever set up their backups.
- Reading the RPO from the backup schedule. Only a restore shows what you would really get back.
Questions
- Can an RPO be zero?
- Close to zero, with synchronous replication, at a cost and with distance limits. It will not protect you from corruption, which gets copied too.
- Who sets the RPO?
- The owner of the business activity, with IT advising on what each target costs.
- How does ransomware affect the RPO?
- Encryption may have run unnoticed, so the last clean copy can be older than the target. That is why older copies are kept.
- What does an RPO of 24 hours mean?
- The company accepts losing up to a day of data. In practice, a backup every night is the minimum to meet it.
- Does a higher backup frequency slow systems down?
- It can, depending on the technique. Snapshots and log shipping limit the effect compared with full copies.
- Is the RPO the same for every system?
- It should not be. A public website and an accounting ledger can tolerate very different amounts of loss.