---
title: "RTO and RPO: the continuity plan that restores operations on time"
description: "Managed business continuity: how to set RTO and RPO per system, protect backups against ransomware and prove recovery with tests. No-obligation proposal."
language: en
url: https://www.dataroad-it.com/en/managed-business-continuity-rto-rpo/
source: https://www.dataroad-it.com/en/managed-business-continuity-rto-rpo/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Managed business continuity: how to set RTO and RPO per system, protect backups against ransomware and prove recovery with tests. No-obligation proposal.

# RTO and RPO: the continuity plan that restores operations on time

At a glance For decision-makers short on time.

- 01 Backup means having copies; continuity means invoicing again within a defined timeframe.
- 02 The board sets RTO (downtime) and RPO (data lost) for each system.
- 03 Against ransomware: 3-2-1 with an immutable copy and restore tests with zero errors.
- 04 A timed quarterly test and an annual exercise with the board present.

### In this article

A well-designed continuity plan gives the board two guarantees in writing: how many hours it will take the company to start invoicing again after an incident, and how much work, at most, will have to be redone. These two commitments are called RTO and RPO. Having backups is a necessary condition, but it is not enough: what protects revenue is the ability to restore everything within the deadline, and a documented test that proves it.

## Why does "we have backup" not answer the risk?

Because the copy is only the starting point. Picture a server that dies on a Monday morning, with a backup made the night before on a USB drive. The copy exists; the company is still at a standstill. Four things are missing to restore operations:

- **Replacement hardware** The failed server cannot take the data back.
- **Expertise and credentials** A technician who knows the system and has passwords and licence keys to hand.
- **Hours of work** Transferring the data, getting the applications running and validating the result.
- **Reconnecting the office** Workstations, printers and permissions that pointed to the old machine.

It is in these four steps that a morning's breakdown turns into a week without invoicing. Many SMEs only find out once it has happened.

## Which two numbers should the board set?

**RTO: Recovery Time Objective.** The maximum downtime the business can tolerate before losses become serious.

**RPO: Recovery Point Objective.** The window of data you accept losing, counted backwards from the incident. With the last backup made at midnight, a problem at 5 p.m. costs a whole day's work.

Read together: an RTO of 4 hours and an RPO of 1 hour mean "we are operational within 4 hours and, in the worst case, we lose the last hour". The decision is a business one. The IT partner translates those values into an architecture and a price, and the tighter they are, the more expensive. Demanding instant recovery for every system is a waste of budget.

### Four steps to set them in one meeting

- **List dependencies**: email, ERP and invoicing, shared folders, sector software, telephony, website.
- **Ask about impact**: ask each manager: "after how many hours of downtime do we start losing clients or revenue?" The answer gives the RTO.
- **Ask about rework**: "how many hours of work are we prepared to repeat?" That gives the RPO.
- **Demand proof**: hand the list to your provider and ask for the solution together with the test that validates it.

## What do the values look like in a real company?

Illustrative scenario: a services company, 40 workstations, invoicing every day, part of the team working from home. The numbers are a reference, not a recipe.

| Service | RTO | RPO | Typical architecture |
| --- | --- | --- | --- |
| ERP and invoicing | 2 to 4 hours | 15 minutes to 1 hour | Several backups a day and a mirror system ready to go into production |
| Email and calendars in Microsoft 365 | 4 hours | 24 hours | Daily backup outside Microsoft's infrastructure |
| Shared folders | 1 working day | 4 to 24 hours | Backups throughout the day, in the office and at an external location |
| Sector software (clinic, hotel, design practice) | 2 to 8 hours | 1 to 4 hours | Replicated virtual server, able to start on other hardware |
| Telephony | 1 hour | Not applicable | Cloud PBX with diversion to mobile phones |
| Company website | 1 to 2 days | 1 week | Weekly backup at the hosting provider |
| Archive from previous years | 1 week | 1 week | Monthly backup on separate media |

The difference between the first and last rows is the economic argument: protecting the archive as if it were the ERP is spending money for no gain; protecting the ERP as if it were the archive is accepting a risk nobody approved.

## Which backup architecture withstands ransomware?

The foundation is still 3-2-1: three copies, on two different media, one of them off-site. Today that is no longer enough. Modern attacks locate and destroy backups reachable over the network before encrypting the servers, so you need an immutable copy, one nobody can delete for a set period, and a final test with zero errors. The US agency CISA advises keeping encrypted, offline backups of critical data and regularly checking that they are intact and available.

Anyone working in Microsoft 365 has an additional blind spot: the native recycle bin only keeps data for a short time. We explain the problem in [why Microsoft 365 needs its own backup](https://www.dataroad-it.com/en/managed-microsoft-365-backup-recovery-windows/).

## Which incidents should the plan protect against?

- **Hardware failure** A disk, server, switch or firewall that stops responding.
- **Cyberattack** Ransomware or unauthorised access that encrypts or deletes data, backups included when they sit on the same network.
- **User error** A deleted folder, an overwritten document, an account removed by mistake.
- **Power or connection outage** Several hours without mains power, as on 28 April 2025. We analyse that day in [eight hours without power or internet: would the office have coped?](https://www.dataroad-it.com/en/blackout-proof-network-infrastructure-business/)
- **Damage to the building** Fire, water or theft of equipment.

## What does this look like in a real project?

The [União de Freguesias de Massamá e Monte Abraão](https://www.dataroad-it.com/en/massama-monte-abraao-server-ups-backups/) contracted DataRoad in 2022, through a public procurement procedure, for a project combining the three layers discussed here: a new enterprise server, installed and configured; a UPS to protect the systems and keep them running; and corporate backup on two fronts, local and cloud, set up and then validated. The previous data and configurations moved to the new infrastructure with no losses.

The local layer ensures fast restores. The cloud layer covers a disaster at the building. Validation turns both into verified commitments rather than assumptions.

## How often should recovery be proven?

Quarterly, at the very least, with a restore of one server in an isolated environment and the time recorded. Annually, with a full exercise attended by the board. Without that record, RTO and RPO are merely intentions.

We have set out the procedure in [the 30-minute restore test to demand from your provider](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/). If an incident is already under way, first read [what to do in the first hours of a data recovery](https://www.dataroad-it.com/en/data-loss-first-hour-response-protocol/).

## What does DataRoad deliver in a managed continuity service?

Under an IT Unlimited contract, DataRoad - IT Services and Consulting sets the recovery objectives with management, sizes the [managed and monitored backups](https://www.dataroad-it.com/en/managed-backup-services-portugal/) to meet them and keeps a record of every test. The [business continuity and disaster recovery](https://www.dataroad-it.com/en/disaster-recovery-services-portugal/) layer adds the start-up sequence, priorities and the communication plan during the incident.

When operations cannot wait until the next working day, the [Premium 365 plan](https://www.dataroad-it.com/en/premium-365-24-7-managed-it/) extends cover to nights, weekends and public holidays.

## Questions decision-makers ask

### What distinguishes RTO from RPO?

RTO measures downtime; RPO measures data lost. The first dictates how quickly you restore; the second dictates how often backups are taken.

### How often should backups be taken?

As often as each system's RPO requires. An ERP with a one-hour RPO needs at least hourly backups; for historical documentation, weekly or monthly is usually enough.

### Is an external drive enough?

No, if it is the only copy. Connected to the server, it can be encrypted in the same attack and is exposed to the same fire or flood; an off-site copy and an immutable copy are essential.

### What investment does disaster recovery require?

It depends directly on the objectives set: restoring in four hours is far cheaper than restoring in fifteen minutes. First set RTO and RPO system by system; only then choose the technology.

## Next step: your company's continuity map in 10 working days

We set the objectives for each system with you, measure what your backup infrastructure achieves today and deliver a prioritised remediation plan. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.

Call +351 211 459 950 * or write to sales@dataroad.pt. One Step Ahead of IT.

**Call to a Portuguese landline.*

## Sources

- [NIST SP 800-34: definition of RTO](https://csrc.nist.gov/glossary/term/recovery_time_objective)
- [NIST SP 800-34: definition of RPO](https://csrc.nist.gov/glossary/term/recovery_point_objective)
- [CISA: ransomware response guide](https://www.cisa.gov/stopransomware/ransomware-guide)

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed IT for business

## One StepAhead of IT.

We stop failures before they reach your business. Every network we design, document and manage is treated as if it were our own.

- **11** years in business, since 2015
- **15+** IT vendor certifications
- **Top 5%** SMEs · scoring.pt

We do **IT** right.

DataRoad IT Unlimited

## Operational continuity is not luck. It is method and contract.

IT Unlimited reduces risk and shows in writing what changed.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/managed-business-continuity-rto-rpo/