RTO, RPO, and recovery tiers
Summarize
Summary of RTO, RPO, and recovery tiers
In the event of disruptions causing downtime, it is critical for organizations to classify business processes into recovery tiers and determine acceptable limits for downtime and data loss. This classification helps minimize operational impact and guides recovery efforts.
Show less
Key Concepts
- Recovery Time Objective (RTO): The maximum time allowed for systems, applications, or networks to recover after an outage without severely impacting business operations. Business users and IT owners contribute to defining RTO through Business Impact Analysis (BIA) and technical assessments within the BCM UIB Workspace.
- Recovery Point Objective (RPO): The maximum acceptable data loss for business processes during a disruption. IT owners estimate RPO by responding to specific assessments configured by BCM administrators.
- Recovery Tiers: Groups of business applications or processes categorized by similar RTO ranges. These tiers help prioritize recovery efforts and align with organizational expectations such as support levels and communication protocols. Typical tiers include Mission Critical, Business Critical, Essential, Non-essential, Critical, and Non-Critical.
- Recovery Timeframe: The total time from disruption onset to resumption of normal operations. BCM administrators configure recovery timeframes (e.g., Immediately, 1 Hour, 4 Hours, up to 2 Weeks) to align with recovery tiers.
Practical Application for ServiceNow Customers
- Use the BCM application’s BIA component to assess and define RTO and RPO by responding to configured assessments, enabling tailored recovery objectives for your business services and IT systems.
- As a BCM administrator, configure recovery tiers and their associated RTO values to categorize business applications by criticality, facilitating prioritized recovery and response strategies.
- Set appropriate recovery timeframes to establish clear expectations on recovery duration, ensuring alignment across business and IT stakeholders.
- Leverage automated recovery tier calculations based on BIA scores and element RTOs for consistent classification and impact assessment.
Expected Outcomes
By effectively defining RTO, RPO, recovery tiers, and recovery timeframes within the Business Continuity Management application, organizations can:
- Prioritize recovery efforts based on business criticality and acceptable downtime/data loss thresholds.
- Ensure coordinated and timely responses to disruptions, minimizing operational and financial impact.
- Maintain clear communication and escalation procedures aligned with recovery priorities.
- Support ongoing business resilience planning through structured impact analysis and configurable recovery parameters.
Due to unforeseen disruptive events, the business processes in your organization can face a downtime. It is important to classify your business processes in the recovery tiers and calculate the amount of time and amount of data loss that your organization can handle without significant effect on the operations.
Recovery time objective
Recovery time objective (RTO) is the maximum amount of time a computer, system, network, or application takes to recover after an outage event or data loss without causing much effect to your business operations.
The business users and IT owners can perform business impact analysis and technical impact analysis respectively by responding to the assessment in the BIA component in the BCM UIB Workspace. A sample view of the Assessments tab is shown in the following example.
If you are the business user, you can estimate the recovery time objective for your business services and processes by responding to the Recovery time objective assessment in the Assessments tab. The questions are displayed in the Recovery time objective assessment tab according to the configuration set up by the BCM administrator. A sample Recovery time objective assessment with demo data is shown in the following example.
Recovery point objective
Recovery point objective (RPO) defines the maximum acceptable data loss that a business process can handle without significant effect on operations.
If you are the IT owner, you can estimate the recovery point objective for your data applications and systems by responding to the Recovery point objective assessment in the BIA. Based on the configuration set up by the BCM administrator, the questions are displayed in the Recovery time objective assessment tab as shown in the following example.
Recovery tier
If you are the BCM administrator, you can classify a set of business applications that follow a similar range of recovery time objective (RTO) values in one type of recovery tier. For example, for the Mission Critical recovery tiers, recovery time objectives can be Immediately, one Hour, and four Hours.
The recovery tiers and their associated recovery time objectives are displayed in the following example.
The BCM administrator can configure a recovery tier and set its recovery time objective as shown in the following example.
- BIA scores and impact assessment result
- Element recovery times
- Mission Critical
- Business Critical
- Essential
- Non-essential
- Critical
- Non-Critical
Recovery tier configuration by the administrators
For more information on how to configure a recovery tier in the Business Continuity Management application, see Configure recovery tiers for BIA.
Recovery timeframe
- Immediately
- 1 Hour
- 4 Hours
- 8 Hours
- 24 Hours
- 72 Hours
- 1 Week
- 2 weeks
The following example shows the configuration of a recovery timeframe in the Business Continuity Management application.
For more information on how to configure a recovery timeframe in the Business Continuity Management application, see Set up recovery timeframe for a recovery tier.