What is RPO and RTO, and what should yours be?

RPO is how much recent work you can afford to lose. RTO is how long you can afford to be down. Those two numbers decide what your backup actually has to do, and almost nobody is asked either one before they are sold a backup product.

You already have both numbers whether you chose them or not. A backup that runs at 11pm gives you an RPO of up to 24 hours: if the laptop dies at 4pm, everything entered since last night is gone. A restore that needs a call to your IT person, a spare machine and most of a working day gives you an RTO of a day. The numbers are real. The only question is whether you picked them or inherited them from whatever was on special. Asked honestly, most owners land near a day of lost work and a day or two of downtime, which is roughly what our founder Adam hears as well.

What the two numbers actually mean

RPO, the recovery point objective, is measured backwards from the moment things broke. It is how far back the last good copy is allowed to be. Nightly backup, RPO of a day. Hourly, RPO of an hour. Continuous, close to zero. Read it as a loss and it stops being a technical setting: how many hours of invoicing, quoting and note-taking could you afford to key in again?

RTO, the recovery time objective, is measured forwards from the same moment. It is how long the business can go without the system before being down stops being an inconvenience. This is the one people get wrong, because they quote the restore time. The restore is a step inside your RTO. Your RTO is the whole outage.

Take a five-person plumbing business. Jobs and invoices live in a cloud accounting platform, photos and certificates in a shared drive, quotes in email. Its owner would probably accept losing half a day of job notes, because the crews can reconstruct them from their phones. Losing a day of invoices is a different matter, because nobody can reconstruct what was billed. So the RPO for job notes might honestly be twelve hours, while invoicing wants an hour. Two systems, two numbers, one business.

The RTO splits the same way. Quoting can wait two days. Taking payment cannot wait two hours, because the customer is standing at the door. Once written down, those numbers price themselves: a two-hour RTO buys hardware and a service contract, and a two-day RTO buys a spare laptop and a Saturday.

Australia's best-known baseline framework leaves these blank on purpose. The Australian Signals Directorate's Essential Eight Maturity Model asks, at its very first maturity level, that backups be "performed and retained in accordance with business criticality and business continuity requirements" (ACSC, November 2023). It names no interval and no recovery target anywhere. That is not a gap in the model. The requirement is yours to supply, and RPO and RTO are what supply it. The same maturity level also asks that "restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises", which is the half that gets skipped. ASD has since announced that the Essential Eight is being retired and replaced over about two years, but the point here outlives the framework: nobody else is going to pick your numbers for you.

Common variations on the same confusion

"My backup runs nightly" answers RPO and says nothing about RTO. It is the most common substitution we see. Knowing a copy exists from last night tells you what you lost. It says nothing about how long it takes to get back, who can do it, or whether they are on annual leave.

RPO is not the same as retention. RPO is how recent your newest copy is. Retention is how far back your oldest copy goes. They fail differently: a short RPO with a short retention will save you from a dead hard drive but will not save you from a corruption you notice in March that started in January. Ransomware and quiet data corruption both need depth. A dead laptop only needs recency.

A synced folder gives you an RPO of seconds and no protection at all. Sync copies changes in seconds, which reads like an RPO of nearly zero. The reality is the reverse: the deletion syncs in seconds too, and so does the encryption. Version history helps, though its depth belongs to your provider and not to you. This is the whole reason cloud storage does not count as a backup on its own, and why the 3-2-1 backup rule still holds up.

RTO is not the vendor's advertised restore time. The real clock starts when something breaks. It includes noticing, deciding it is serious, finding out who has the credentials, sourcing a machine to restore onto, the restore itself, and then checking the result is complete. The advertised figure is usually one link in that chain. Time the chain.

Neither number means anything without a tested restore. An RPO of one hour on a backup nobody has ever restored is an assumption with a green tick beside it, which is the case Adam makes in a backup you haven't restored is a hope.

What your own platform's documentation would have told you

If the business runs on Microsoft 365, you already have published numbers. They are just not labelled RPO and RTO, and they are shorter than most owners assume.

• Permanently deleted email: 14 days by default. An item deleted from Deleted Items goes to Recoverable Items "and kept there for 14 days, by default", extendable to a maximum of 30 (Microsoft).
• A departed staff member's mailbox: 30 days. Delete the mailbox, or simply remove the licence to save money, and the data is held for 30 days. After that Microsoft says it "is deleted and can't be recovered" (Microsoft).
• Files in SharePoint and OneDrive: 93 days. That single window spans both recycle bin stages, and at the end of it the document is permanently deleted from wherever it is sitting (Microsoft).
• Anything removed programmatically: immediately. Microsoft's own documentation notes that deleting through the API, as some third-party tools do, purges the item straight away and it "isn't recoverable" from either recycle bin (Microsoft).

Microsoft is unambiguous about whose job the rest is: across every cloud deployment type, Microsoft 365 included, "you own your data and identities" and you are responsible for protecting them (Microsoft). Microsoft keeps the service running. Whether your data comes back is measured against your numbers, not theirs. We answer the narrow version in is Microsoft 365 backed up by Microsoft.

Google Workspace, Xero, MYOB and every booking platform publish their own equivalents. Look up the ones you pay for, because that published window is your real RPO until you add something on top of it.

How to set your own RPO and RTO this week

This is an hour of thinking, not a project. If you just want the two definitions on one card to hand to someone else, we keep a short version.

• List the three things that stop you trading. Taking payment, reaching customers, getting at records, in whatever order is true for you. Ignore everything else.
• Give each one an RPO by asking what you would have to redo. If the last copy is from last night, how many hours of work is that, and what does it cost to key in again? The answer is your honest RPO, not the one you would like.
• Give each one an RTO by asking when it starts costing you. A customer, a payroll run, a compliance deadline. Be specific about which, because vague urgency is what makes people buy a four-hour target they do not need.
• Look up what you currently have. Open the backup tool and read two things: the schedule and the retention. Then read your platform's published window, as above. Write the actual numbers next to the ones you just chose.
• Restore one real file and time the whole thing. From "something is wrong" to "the file is open and correct". That measurement is your only honest RTO, and once a quarter is enough to keep it true.
• Close the widest gap first, cheapest option available. Usually that is a mailbox and file backup with retention in months instead of days, for the price of a couple of coffees a week.

If your first instinct was "an hour" for everything, you are describing a budget rather than a business.

Worth knowing before the bad day: if the incident involves personal information, a second clock starts alongside the trading one. Under the Notifiable Data Breaches scheme an organisation must take all reasonable steps to complete its assessment of a suspected eligible data breach within 30 calendar days of becoming aware of the grounds for suspicion (OAIC, February 2025). That is an assessment deadline, not a recovery one, and the clock starts at suspicion rather than confirmation. Your insurer will ask for the same two numbers in plainer words, which is one reason whether you need cyber insurance is better answered while everything is calm.

When an RPO and an RTO aren't enough

Both are a decision, not a capability. Written down and unmet is the normal state of affairs, and it is still progress, because a gap you can see becomes a shopping list. Working through the list is the actual job.

They also only cover the systems you already know you depend on. The supplier whose platform your bookings live inside, the domain renewal nobody owns, the one person who knows the bank login: none of those has a backup schedule, and all of them can stop you trading. Working that out is the wider exercise, and it is what goes into a written continuity plan and our guide to keeping a small business trading when something breaks.

Our scan will not tell you either number, and we are not going to imply otherwise. It measures what is publicly visible about your domain, your email and your website: certificates, DNS, authentication, security headers. That is the keeping-people-out half of the problem. Continuity is not visible from the outside, so we do not measure it and we do not grade it. Red Bridge Cyber is a paid subscription, at $100 a month or $1,000 a year, with scoped Custom Engagements quoted individually, and it is worth exactly what it measures.

Two numbers, per system, written down this week. That is the whole task, and it is the difference between owning a backup and knowing what it is for.

---

Sources

• Australian Cyber Security Centre, Essential Eight Maturity Model - retrieved 7 August 2026, https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
• Office of the Australian Information Commissioner, Part 4: Notifiable Data Breach (NDB) Scheme - retrieved 7 August 2026, https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme
• Microsoft, Change how long permanently deleted items are kept for an Exchange Online mailbox - retrieved 7 August 2026, https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention
• Microsoft, Delete or restore user mailboxes in Exchange Online - retrieved 7 August 2026, https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes
• Microsoft, Learn about retention for SharePoint and OneDrive - retrieved 7 August 2026, https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint
• Microsoft, Microsoft 365 SharePoint data deletion - retrieved 7 August 2026, https://learn.microsoft.com/en-us/sharepoint/sharepoint-data-deletion
• Microsoft, Shared responsibility in the cloud - retrieved 7 August 2026, https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
• Red Bridge Cyber, perspective: A Backup You Haven't Restored Is a Hope, Not a Backup