Two simple numbers decide how badly a bad day hurts: how much work you lose, and how long you are shut. Most owners have never set either.

On 28 October 2023, ransomware hit the British Library, one of the largest and best resourced institutions of its kind in the world. Its main catalogue, the system readers use to find anything, stayed offline for about two and a half months, not coming back until mid January 2024. The full technical rebuild ran far longer, and the recovery bill reached close to 9 million US dollars. The attack was one night. Being unable to operate normally lasted into the following year. That gap, between the incident and the day things truly work again, is the thing two plain numbers are meant to control.

Those two numbers sound technical, but each answers an ordinary business question. The first is RPO, the recovery point objective. In plain terms: how much work can you afford to lose? It is measured backwards from the moment things break to your last good backup. If you back up once a night and the system dies at 4pm, everything done since the last backup, a whole day of orders, invoices and records, is gone. That lost day is your RPO. Back up every hour instead, and at worst you lose an hour.

The second is RTO, the recovery time objective. In plain terms: how long can you afford to be down? It is the clock from the moment you stop to the moment you are trading normally again. The British Library’s was, in effect, months. For a small business taking orders and payments, the honest question is simpler: could you survive one day shut, three days, a week? The answer is your real RTO, whether or not you have ever named it.

Here is where most businesses quietly come unstuck. They have backups, so they feel covered, but they have never set either number. That means their true RPO is “however old the last backup happens to be,” and their true RTO is “however long it takes, whenever someone gets to it.” Both are discovered for the first time in the middle of the crisis, which is the worst possible moment to learn them. Deciding the numbers in advance is what turns a backup into a plan.

And the numbers are a business decision, not a technical one, because only you can say what the business can bear. BigBand’s role is to build an arrangement that meets the targets you set: how often your data is copied, so your RPO is hours not days, and how fast a Malaysian team restores you, so your RTO is hours not weeks, with a clean, encrypted copy kept offsite in the Tier III Cyberjaya facility and someone accountable for hitting both. Twenty years of doing this locally is what makes a promised recovery time believable.

Book Your Business Recovery Review
+60 3 5879 3933   |   [email protected]