Recovery Point Objective (RPO)

Security Operations 🛡️ • Governance (GRC) 📜 • Sec+ Glossary 📖 Difficulty: premium

What is Recovery Point Objective (RPO)?

Recovery Point Objective, or RPO, is the maximum amount of data loss an organization is willing to accept after a disruption, measured as a period of time.

Examples

  • A finance system with an RPO of 15 minutes must be recoverable to a point no more than 15 minutes before the incident.
  • A company decides that its internal wiki can tolerate an RPO of 24 hours because losing one day's edits would be inconvenient but manageable.

Discover 🔎

When systems fail, the problem is not only how long recovery takes. Another question matters just as much: how much recent data can the organization afford to lose? If a database is restored from an older backup, everything entered after that backup may be gone. In some environments that might be tolerable. In others, it could be a major business or safety problem.

That is the purpose of RPO. It gives a clear limit on acceptable data loss by expressing how far back in time recovery is allowed to go. Instead of saying vaguely that backups are important, the organization defines how current the recovered data must be after an incident.

Remember: RPO is about lost data measured in time, not about how long the system stays offline.

Summary 📝

Recovery Point Objective defines how much recent data loss an organization can tolerate after an incident. It is measured in time because recovery often means returning to an earlier point rather than preserving every last change. RPO is valuable because it connects business impact to backup and replication design, helping teams decide how current restored data must be when recovery begins.

Open the interactive lesson Browse more topics

Tip: The interactive version includes progress tracking, decks, and premium deep dives.