Managed business continuity: RTO, RPO and backups that restore operations in time

Because the copy is only the starting point. Picture a server that dies on a Monday morning, with a backup made the night before on a USB drive. The copy exists; the company is still at a standstill. Four things are missing to restore operations:

• Replacement hardware The failed server cannot take the data back.
• Expertise and credentials A technician who knows the system and has passwords and licence keys to hand.
• Hours of work Transferring the data, getting the applications running and validating the result.
• Reconnecting the office Workstations, printers and permissions that pointed to the old machine.

It is in these four steps that a morning's breakdown turns into a week without invoicing. Many SMEs only find out once it has happened.

RTO — Recovery Time Objective. The maximum downtime the business can tolerate before losses become serious.

RPO — Recovery Point Objective. The window of data you accept losing, counted backwards from the incident. With the last backup made at midnight, a problem at 5 p.m. costs a whole day's work.

Read together: an RTO of 4 hours and an RPO of 1 hour mean "we are operational within 4 hours and, in the worst case, we lose the last hour". The decision is a business one. The IT partner translates those values into an architecture and a price — and the tighter they are, the more expensive. Demanding instant recovery for every system is a waste of budget.

Four steps to set them in one meeting

1. List dependencies — email, ERP and invoicing, shared folders, sector software, telephony, website.
2. Ask about impact — ask each manager: "after how many hours of downtime do we start losing clients or revenue?" The answer gives the RTO.
3. Ask about rework — "how many hours of work are we prepared to repeat?" That gives the RPO.
4. Demand proof — hand the list to your provider and ask for the solution together with the test that validates it.

Illustrative scenario: a services company, 40 workstations, invoicing every day, part of the team working from home. The numbers are a reference, not a recipe.

The difference between the first and last rows is the economic argument: protecting the archive as if it were the ERP is spending money for no gain; protecting the ERP as if it were the archive is accepting a risk nobody approved.

The foundation is still 3-2-1: three copies, on two different media, one of them off-site. Today that is no longer enough. Modern attacks locate and destroy backups reachable over the network before encrypting the servers, so you need an immutable copy — one nobody can delete for a set period — and a final test with zero errors. The US agency CISA advises keeping encrypted, offline backups of critical data and regularly checking that they are intact and available.

Anyone working in Microsoft 365 has an additional blind spot: the native recycle bin only keeps data for a short time. We explain the problem in why Microsoft 365 needs its own backup.

• Hardware failure A disk, server, switch or firewall that stops responding.
• Cyberattack Ransomware or unauthorised access that encrypts or deletes data, backups included when they sit on the same network.
• User error A deleted folder, an overwritten document, an account removed by mistake.
• Power or connection outage Several hours without mains power, as on 28 April 2025. We analyse that day in eight hours without power or internet: would the office have coped?
• Damage to the building Fire, water or theft of equipment.

The União de Freguesias de Massamá e Monte Abraão contracted DataRoad in 2022, through a public procurement procedure, for a project combining the three layers discussed here: a new enterprise server, installed and configured; a UPS to protect the systems and keep them running; and corporate backup on two fronts, local and cloud, set up and then validated. The previous data and configurations moved to the new infrastructure with no losses.

The local layer ensures fast restores. The cloud layer covers a disaster at the building. Validation turns both into verified commitments rather than assumptions.

Quarterly, at the very least, with a restore of one server in an isolated environment and the time recorded. Annually, with a full exercise attended by the board. Without that record, RTO and RPO are merely intentions.

We have set out the procedure in the 30-minute restore test to demand from your provider. If an incident is already under way, first read what to do in the first hours of a data recovery.

Under an IT Unlimited contract, DataRoad - IT Services and Consulting sets the recovery objectives with management, sizes the managed and monitored backups to meet them and keeps a record of every test. The business continuity and disaster recovery layer adds the start-up sequence, priorities and the communication plan during the incident.

When operations cannot wait until the next working day, the Premium 365 plan extends cover to nights, weekends and public holidays.

We set the objectives for each system with you, measure what your backup infrastructure achieves today and deliver a prioritised remediation plan. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.

Call +351 211 459 950* or write to sales@dataroad.pt. One Step Ahead of IT.

*Call to a Portuguese landline.

• NIST SP 800-34: definition of RTO
• NIST SP 800-34: definition of RPO
• CISA: ransomware response guide