How to Establish Effective RPO and RTO Targets for Cloud Infrastructure

When a disaster strikes—whether it is ransomware, hardware failure, or a data center outage—the first two questions every CEO asks the IT team are always: "When will the system be back up?" and "How much data did we lose?"

Those are exactly the two questions that RPO and RTO are born to answer—and more importantly, to prepare for long before the questions are ever asked.

According to Gartner, the average cost of IT downtime is $5,600 per minute. For small and medium-sized businesses (SMBs), this figure hovers around $1,670 per minute. More alarmingly, 96% of organizations report downtime costs exceeding $100,000 per hour—yet only 54% of businesses currently have a fully documented disaster recovery plan.

RPO and RTO are not academic concepts. These are two critical metrics that directly dictate infrastructure investment budgets, backup strategies, and a business's survival capacity when disaster hits.

1. What Is RPO? (Recovery Point Objective)

Definition: RPO (Recovery Point Objective) is the maximum acceptable age of data that a business can tolerate losing when a disruption occurs. RPO determines the frequency of backups required to protect data within acceptable thresholds.

Put simply: If the system crashes right now, how many hours or minutes of prior data can you afford to lose?

RPO directly dictates backup frequency:

• RPO = 4 hours → Backup every 4 hours
• RPO = 1 hour → Backup every hour
• RPO Near-Zero → continuous data protection (CDP) or real-time replication

An e-commerce company that backs up its data every 4 hours has an RPO = 4 hours. If the system crashes, all transactions and orders within that window will be lost. For banks or fintech companies, this figure must be under 15 minutes—because no financial transaction can afford to be lost.

Is RPO = 0 feasible? Yes, it is entirely possible from a technical standpoint using CDP or synchronous replication. However, the costs increase significantly. In practice, after calculating the cost-benefit ratio, most businesses opt for an RPO of 1–4 hours instead of RPO = 0, saving substantial budgets while maintaining data safety.

2. What Is RTO? (Recovery Time Objective)

efinition: RTO (Recovery Time Objective) is the maximum tolerable duration of time that a system can be down after a disaster before it must be fully restored. RTO determines the required level of investment in recovery infrastructure.

Put simply: After a disaster occurs, how long can the business survive without the system?

RTO directly dictates recovery infrastructure investment:

• RTO 24 hours → Simple cold backup, low cost
• RTO 4 hours → warm standby, medium cost
• RTO < 1 hours → hot standby hoặc automated failover, high cost

A bank specifies that if its core banking system stops for more than 4 hours, it will violate customer SLAs and face penalties from the State Bank. The RTO for that system is 4 hours—the entire Disaster Recovery (DR) infrastructure must be designed to guarantee restoration within that timeframe.

How does RTO differ from actual recovery time? RTO is a target—the metric set and aimed for when designing infrastructure. Actual recovery time is what really happens during a live incident. Many businesses in Vietnam set a 4-hour RTO on paper but take 12–24 hours to recover in reality. This happens because backups are not tested periodically, or they rely on unstable international internet bandwidth.

3.Core Differences Between RPO and RTO

Key Takeaway: RPO and RTO are two entirely independent dimensions. A business can have a low RPO (minimal data loss) but a high RTO (slow recovery), or vice versa. The ideal—and most expensive—scenario is keeping both low. Most businesses need to find a sweet spot that aligns with their budget and risk tolerance.

RPO vs RTO timeline diagram showing backup points, disaster event, and system recovery flow

4. How to Calculate the Right RPO and RTO for Your Business

The most common mistake is setting RPO and RTO based on guesswork: "Let's just back up once a day for convenience." The correct approach is to calculate backward from the actual cost of downtime.

Step 1 — Calculate Hourly Downtime Costs

This is a question for the CFO, not the IT team: For every hour the system is down, how much money does the business lose?

Factors to include:

• Direct lost revenue (unprocessed orders)
• Idle staff costs (salary X number of affected employees X hours)
• SLA non-compliance penalties with customers and partners
• Legal and regulatory non-compliance fines
• Brand reputation damage

Step 2 — Tier Systems by Criticality

Not all systems require the same RPO/RTO. Tiering helps optimize investment costs:

Tier 1 — Mission Critical (core banking, payment gateways, primary ERP):

• Target RTO: Under 1 hour
• Target RPO: Under 15 minutes
• Solution: Real-time replication, hot standby

Tier 2 — Business Critical (Email, CRM, e-commerce website):

• Target RTO: 1–4 hours
• Target RPO: 1–4 hours
• Solution: Hourly backups, warm standby

Tier 3 — Standard (Internal tools, reporting, legacy archiving):

• Target RTO: 8–24 hours
• Target RPO: 24 hours
• Solution: Daily backups, cold storage

System tiering pyramid chart for disaster recovery by RTO, RPO, and infrastructure cost

Bước 3 — Align with Investment Budget

Simple Rule: The cost of investing in backup infrastructure should not exceed the downtime cost you are trying to avoid.

Once you have a clear hourly downtime cost, infrastructure budgeting becomes a straightforward financial equation rather than an emotional IT decision.

5. Benchmark RPO and RTO by Industry in Vietnam

5.5 Small and Medium Enterprises (SMB)

• Typical RTO: 4–24 hours
• Typical RPO: 4–24 hours
• Reality: Most Vietnamese SMBs lack documented RPO/RTO strategies. When an incident occurs, actual recovery times are often 3 to 5 times longer than expected.

6. Why Do Paper RPO/RTO Metrics Often Fail in Reality?

This is a dangerous gap that many businesses fail to realize until it is too late:

1. Backups are not tested periodically: Many companies back up regularly but have never executed a real restore drill. Backup files can be corrupted, incomplete, or incompatible with current software versions. A 24-hour RPO on paper can translate to permanent data loss in reality.
2. Dependency on international bandwidth: When backups are stored on AWS S3 Singapore or Google Cloud Tokyo, restoration speeds are bottlenecked by international internet circuits. A 4-hour RTO on paper can easily morph into 18–24 hours in reality—especially during under-sea fiber optic cable disruptions.
3. Lack of scheduled DR drills: The best recovery plan is useless if the IT team has never practiced it. Untrained procedures drastically extend recovery time when a disaster strikes outside of business hours.

7. RPO, RTO, and the Role of Local Cloud Backup

Choosing your infrastructure provider directly impacts actual RTO—not just RTO on paper.

The core issue with international clouds in Vietnam: When data centers are located in Singapore or Tokyo, all restore operations travel through international lines with unpredictable bandwidth. This architectural bottleneck keeps actual RTO higher than committed RTO—making it particularly risky during local fiber optic cable cuts.

The Solution: Domestic Data Centers with S3-Compatible Object Storage. 
When object storage and compute reside within the same data center in Vietnam, the entire restoration process runs on a local network at LAN speeds. Actual RTO closely matches committed RTO—insulated from international connectivity incidents.

That is why over 1,000 businesses run their backup systems on GreenNode's infrastructure, featuring Tier III standard Data Centers located right in Vietnam:

Actual RTO = Committed RTO: LAN-speed restoration, free from international bandwidth dependencies.

Flexible RPO by Tier: Supports hourly backups for Tier 1 and daily backups for Tier 3. Automated lifecycle policies smoothly transition data between Gold Tier and Instant Archive Tier.

100% Data Sovereignty Compliance: Fully satisfies the 2018 Cybersecurity Law and Decree 13/2023/ND-CP, which mandate that the personal data of Vietnamese users must be stored within the territory of Vietnam.

Frequently Asked Questions (FAQs)

1. How do RPO and RTO differ?

RPO measures the maximum allowable data loss (expressed in time), while RTO measures the maximum allowable system downtime. RPO dictates backup frequency; RTO dictates recovery infrastructure investment. These two metrics are completely independent and must be defined separately for each system.

2. What is a "good" RPO and RTO?

There is no single "good" number—everything depends on your actual downtime costs and specific systems. As a rule of thumb, infrastructure investment should not exceed the downtime losses you seek to prevent. Standard benchmark: Fintech/banking requires RTO < 4 hours and RPO < 1 hour; standard SMBs can tolerate RTO/RPO between 4–24 hours.

3. How do you calculate RPO for an SMB?

Step 1: Identify mission-critical systems. Step 2: Calculate the losses incurred if data vanishes for 1 hour, 4 hours, or 24 hours. Step 3: Pick a backup frequency that balances data protection with operational costs. For SMBs, a 4-hour RPO for critical systems and a 24-hour RPO for standard systems is usually a great sweet spot.

4. What does RPO = 0 mean?

An RPO of zero means zero data loss when a crash occurs. This is achieved via synchronous replication or Continuous Data Protection (CDP). While technically viable, it comes with premium costs and is usually reserved for Tier 1 systems like core banking or real-time payment processing networks.

5. Does Cloud Backup help achieve a lower RTO?

Yes, but it depends heavily on data center location. Local cloud backup (data centers inside Vietnam) enables LAN-speed restoration, keeping actual RTO tightly aligned with your goals. Conversely, global cloud backup (Singapore, Tokyo) can hit bandwidth bottlenecks, blowing out actual recovery times—especially during international fiber optic outages.

6. Are Vietnamese businesses legally required to meet specific RPO/RTO metrics?

There is no blanket law governing RPO/RTO for all businesses. However, specific industries have distinct mandates: banks and credit institutions must follow State Bank regulations on system resilience; healthcare facilities must comply with Ministry of Health rules on electronic medical record archiving. Additionally, the 2018 Cybersecurity Law and Decree 13/2023/ND-CP mandate local data residency for personal user data.

7. What is the difference between RTO and MTTR?

RTO is a target—the benchmark you design your infrastructure to hit. MTTR (Mean Time To Recovery) is an empirical metric—the average time it actually takes to recover across past incidents. Businesses must ensure that their actual MTTR stays below their target RTO. A wide gap between MTTR and RTO is a red flag that your backup infrastructure needs an overhaul.

Conclusion 
RPO and RTO are not just technical metrics for the IT department. They are a business commitment—numbers that the CEO, CFO, and CTO must co-sign and own together.

Setting the right RPO/RTO from the ground up determines:

1. Exactly how much the business invests in backup infrastructure—no more, no less.
2. Which architecture to select so that committed RPO/RTO is guaranteed in real life.
3. Whether the business meets regulatory requirements and lives up to customer SLAs.