Disaster Recovery RPO/RTO Planner

Formula

TotalEventCost = (RPO × DataLossCost) + (RTO × DowntimeCost)

The cost of a disaster is the sum of lost data value (RPO hours lost) and lost revenue during recovery (RTO hours down). We compare this 'Event Cost' against the annual 'Insurance Premium' (DR Infrastructure Cost) to find the optimal strategy.

Worked Examples

Example 1: Low Cost Strategy

Problem:RPO 24h, RTO 48h, $500/mo. Event Cost: $360k.

Solution:Cheap insurance, but a disaster will be catastrophic.

Result:High Risk / Low OpEx

Example 2: High Availability Strategy

Problem:RPO 1h, RTO 4h, $2000/mo. Event Cost: $22k.

Solution:Expensive insurance ($24k/yr), but saves $338k per event.

Result:Low Risk / High OpEx

Frequently Asked Questions

What is the RPO/RTO trade-off?

Lowering RPO/RTO (faster recovery) exponentially increases infrastructure costs (synchronous mirroring, hot standby). Increasing them lowers cost but raises business risk.

How many events should I plan for?

Major disasters are rare (1 every 5-10 years), but minor outages (software bugs, failed deployments) are common. Plan for 1 significant recovery event per year for ROI purposes.

What is an 'Active-Active' setup?

Two live sites serving traffic. If one fails, the other takes over instantly (RTO ~0). This is the most expensive strategy (2x infrastructure cost).

Does RPO include Ransomware?

Yes, but differently. For ransomware, you revert to a clean backup *before* the infection. Your RPO is effectively 'Time since infection', which could be days.

Why differentiate RPO and RTO?

They drive different costs. RPO drives Storage/Network cost (frequency of sync). RTO drives Compute/Automation cost (speed of boot/failover).

Background & Theory

The Cost Curve

The relationship between Cost and Recovery Speed is asymptotic.
Moving from 24h to 4h RTO costs $$.
Moving from 4h to 15min RTO costs $$$$.
Moving from 15min to 0min costs $$$$$$.

Scenario Planning

Don't just have one plan. Tier your applications:

Tier 1 (Gold): RPO < 15m, RTO < 1h. (Customer-facing transaction apps).
Tier 2 (Silver): RPO 4h, RTO 8h. (Internal reporting).
Tier 3 (Bronze): RPO 24h, RTO 48h. (Dev environments).

Practical Tips

Test the 'Failback': Failing over to DR is easy. Failing *back* to primary without losing data is the hard part.
Automate DNS: The longest delay in RTO is often waiting for DNS TTL to expire. Use low TTLs or Anycast IP.
Communication Plan: The tech part is solvable. Knowing *who* makes the decision to declare a disaster is often the bottleneck.

History

The Cold Site Era

In the 1990s, DR meant renting a "Cold Site"—an empty data center with power and ping. In a disaster, you shipped servers there. RTO was measured in weeks. Cost was low (just real estate).

The Hot Site Era

Financial firms needed better. "Hot Sites" maintained mirrored hardware running 24/7. RTO was minutes. Cost was extreme (2x hardware, 2x software licenses, 2x real estate). Only the Fortune 500 could afford this.

The Cloud & DRaaS Era

Virtualization and Cloud democratized DR. You no longer need 2x hardware. You can keep a "Pilot Light" (tiny VM) running in AWS and scale it up only when disaster strikes. "DR as a Service" (DRaaS) tools like Zerto and Veeam made sub-15 minute RPO/RTO affordable for SMBs.

Common Misconceptions

Myth: "Backups are DR." Reality: Backups are just files. DR is the *process* of turning those files back into a running application.
Myth: "Cloud never fails." Reality: AWS Regions go down. You need Multi-Region DR for true resilience.