RTO, RPO, and recovery tiers

  • Release version: Yokohama
  • Updated July 31, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of RTO, RPO, and recovery tiers

    In the context of business continuity, it is crucial for organizations to classify business processes into recovery tiers and determine their tolerance for downtime and data loss. This helps ensure minimal disruption during unforeseen events such as outages or data loss. The key metrics involved are Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

    Show full answer Show less

    Recovery Time Objective (RTO)

    RTO represents the maximum allowable time for recovery of a system, application, or business process after an outage without severely impacting business operations. Business users and IT owners contribute to assessing RTO by responding to structured assessments within the Business Impact Analysis (BIA) component of the BCM UIB Workspace. These assessments help estimate how quickly services and processes should be restored.

    Recovery Point Objective (RPO)

    RPO defines the maximum acceptable amount of data loss, measured in time, that a business process can tolerate without significant operational impact. IT owners estimate RPO values by completing assessments focused on data applications and systems within the BIA. This enables organizations to understand and plan for data recovery priorities.

    Recovery Tiers

    Recovery tiers categorize business applications and processes based on similar RTO ranges to streamline recovery planning. For example, mission-critical tiers might include recovery objectives like immediate, one hour, or four hours. These tiers are configured by BCM administrators and link to organizational expectations such as support, escalation, and communication levels.

    • Recovery tiers influence BIA scores, impact assessment results, and element recovery times.
    • Organizations typically set between 4 to 6 recovery tiers based on criticality, such as Mission Critical, Business Critical, Essential, Non-essential, Critical, and Non-Critical.
    • Recovery tiers are automatically assigned to BIAs and elements by matching the nearest maximum recovery time.

    Recovery Timeframe Configuration

    The recovery timeframe defines the period from when a disruptive event occurs until normal business operations resume. BCM administrators can configure multiple recovery timeframes (e.g., Immediately, 1 Hour, 4 Hours, 8 Hours, 24 Hours, 72 Hours, 1 Week, 2 Weeks) within the Business Continuity Management application to reflect organizational recovery requirements.

    Practical Application for ServiceNow Customers

    • Use the BCM UIB Workspace to conduct BIA assessments that determine RTO and RPO values for your business services and IT systems.
    • Leverage recovery tiers configured by BCM administrators to prioritize and categorize applications and processes according to their criticality and recovery needs.
    • Configure recovery timeframes aligned with your business continuity strategy to ensure clear recovery targets following disruptions.
    • Understand that these configurations directly affect impact assessments and recovery planning, enabling your organization to minimize downtime and data loss effectively.

    Due to unforeseen disruptive events, the business processes in your organization can face a downtime. It is important to classify your business processes in the recovery tiers and calculate the amount of time and amount of data loss that your organization can handle without significant effect on the operations.

    Recovery time objective

    Recovery time objective (RTO) is the maximum amount of time a computer, system, network, or application takes to recover after an outage event or data loss without causing much effect to your business operations.

    The business users and IT owners can perform business impact analysis and technical impact analysis respectively by responding to the assessment in the BIA component in the BCM UIB Workspace. A sample view of the Assessments tab is shown in the following example.

    Assessments in the BIA.

    If you are the business user, you can estimate the recovery time objective for your business services and processes by responding to the Recovery time objective assessment in the Assessments tab. The questions are displayed in the Recovery time objective assessment tab according to the configuration set up by the BCM administrator. A sample Recovery time objective assessment with demo data is shown in the following example.

    Recovery time objective assessment.

    Recovery point objective

    Recovery point objective (RPO) defines the maximum acceptable data loss that a business process can handle without significant effect on operations.

    If you are the IT owner, you can estimate the recovery point objective for your data applications and systems by responding to the Recovery point objective assessment in the BIA. Based on the configuration set up by the BCM administrator, the questions are displayed in the Recovery time objective assessment tab as shown in the following example.

    Recovery point objective assessment.

    Recovery tier

    If you are the BCM administrator, you can classify a set of business applications that follow a similar range of recovery time objective (RTO) values in one type of recovery tier. For example, for the Mission Critical recovery tiers, recovery time objectives can be Immediately, one Hour, and four Hours.

    The recovery tiers and their associated recovery time objectives are displayed in the following example.

    Recovery tiers and their configured recovery time objectives.

    The BCM administrator can configure a recovery tier and set its recovery time objective as shown in the following example.

    Recovery tier and its recovery time objective.

    Recovery tiers are also associated with other organizational expectations such as levels of support, escalation, and communication. Recovery tiers are used in the following areas:
    • BIA scores and impact assessment result
    • Element recovery times
    Although there is no limitation to the number of the recovery tiers, an organization can set 4 to 6 recovery tiers. Recovery tiers are automatically calculated on BIAs and element RTO by selecting the nearest recovery tier maximum time.
    Recovery tiers can be classified as per their importance and criticality:
    • Mission Critical
    • Business Critical
    • Essential
    • Non-essential
    • Critical
    • Non-Critical

    Recovery tier configuration by the administrators

    For more information on how to configure a recovery tier in the Business Continuity Management application, see Configure recovery tiers for BIA.

    Recovery timeframe

    You can set up the recovery timeframe for a recovery tier. It is the timeframe that starts from when a disruptive event happens to the time when your business can resume usual operations. The BCM administrator can configure the recovery timeframe and its start time. You can configure different recovery timeframes as shown in the following example:
    • Immediately
    • 1 Hour
    • 4 Hours
    • 8 Hours
    • 24 Hours
    • 72 Hours
    • 1 Week
    • 2 weeks
    The following example shows the configured recovery timeframes in the Business Continuity Management application. Recovery timeframes.

    The following example shows the configuration of a recovery timeframe in the Business Continuity Management application. New recovery timeframe.

    For more information on how to configure a recovery timeframe in the Business Continuity Management application, see Set up recovery timeframe for a recovery tier.