What is the difference between RTO and RPO, and how do you design a backup strategy?

RTO (Recovery Time Objective) — how long you can afford to be down. It drives your recovery infrastructure.

RPO (Recovery Point Objective) — how much data you can afford to lose, measured in time. It drives your backup frequency. An RPO of one hour means backing up at least hourly.

Both are business decisions, not technical ones. The cost rises steeply as either approaches zero, so the conversation is about what an hour of downtime or an hour of lost data actually costs.

Designing the strategy:

• The 3-2-1 rule — three copies of the data, on two different media types, with one off-site. It survives hardware failure, site loss, and most ransomware.
• Match backup type to RPO. Full backups are simple to restore but slow and large; incremental are fast to take but slower to restore; differential sit between. A common pattern is weekly full plus daily incremental.
• Immutable or air-gapped copies. This is now essential — ransomware specifically targets backups, and a backup an attacker can delete is not a backup.
• Retention aligned to legal and regulatory requirements, not to disk convenience.

Note: The point to emphasise above all: an untested backup is not a backup. Restore drills on a schedule, timed against the RTO, are what turn a backup policy into a recovery capability. A great many organisations discover their backups were unusable only when they need them.