Comparison
Recovery point objectivevsRecovery time objective
Recovery point objective
backups run nightly, so recovering means losing up to a day of writes, and nobody outside the platform team knew that.
The maximum acceptable data loss, expressed as time: how far back you may be forced to rewind. It is set by replication and backup frequency, so nightly snapshots mean a day and synchronous replication means approximately none. It is the number people conflate with recovery time, and the two are independent — you can be back in ten minutes having lost a day, or take a day to restore losing nothing.
Full entry →Recovery time objective
the business says four hours, and the restore has never been timed, so nobody knows whether that is true.
The maximum acceptable time to restore service after a disaster: how long you may be down. It is a business decision that dictates architecture, because an hour and a day buy completely different designs. The only honest way to hold it is to measure a real restore, since an untimed objective is a number in a document rather than a property of the system.
Full entry →