What is an RTO/RPO in Catalyst?

Follow

Catalyst makes use of RTO and RPO fields throughout the system to help establish the timeline needed for recovery planning. This article will explain where RTOs and RPOs can be entered, how they are auto populated and from where, and who has permission to edit them.

First, for those new to Business Continuity, what is an RTO and an RPO?

The recovery time objective, or “RTO”, is the maximum tolerable length of time that a business process, computer, system, network, or application can be down after following an interruption.

A recovery point objective, or “RPO”, is the maximum targeted period in which data might be lost from an IT service due to a major incident.

The terms in this article reflect the default terminology found in Catalyst out of the box; some terms may change. Catalyst uses the RTO/RPO data collected in certain areas to make recommendations about RTO/RPOs in other areas. This data is also scored on the Business Continuity side through capability scoring in Insights to compare Requested RTOs for dependencies to Committed RTOs for the BIA Activities.

Below, you will find a table with each module that accepts RTO/RPO fields and how they are used in the system.

 

Products and Services

Committed Maximum Downtime*

This is the amount of time the organization can function without producing this product or providing this service. 

This value is used in BIA – Activities as a Suggested Recovery Time.

Proven Maximum Downtime*

This is the amount of time, through exercises or incidents, that the organization has proven to be able to restore this product or service.

* Restricted fields that are only available for users with BC Team or Account Owner Role.

 

Supplier

Committed Maximum Downtime* This is the amount of time the Supplier has committed to restoring their service or product to the organization.
Proven Maximum Downtime* This is the amount of time, through exercises or incidents, that the supplier has proven to be able to restore this product or service.

* Restricted fields that are only available for users with BC Team or Account Owner Role.

 

BIA – Activity

Requested RTO This is the the business owner’s estimation of the maximum amount of time the activity can cease operations before a significant impact is felt to the organization.
This value is used as a Suggested Recovery Time for Application Dependencies and Other Dependencies.
Suggested Recovery Time This is based on the Committed Maximum Downtime for a linked product or service. This shows the lowest downtime of all selected products or services.
Committed Maximum Downtime* This is the amount of time this activity can be down without creating additional impact.
Proven Maximum Downtime* This is the amount time, through exercises or incidents, that the activity has proven to be able to reach recovery.

* Restricted fields that are only available for users with BC Team or Account Owner Role.

 

BIA – Application Dependency

Requested RTO This is the amount of time the BIA Owner or Contributor has requested the application be restored in able to resume their activity.
This value is pulled into Applications through the Lowest Requested RTO
Suggested Recovery Time This is based on the Requested RTO for a linked activity. This shows the lowest RTO of all selected activities.
Data Loss Tolerance This is the requested amount of data loss (RPO) to be able to resume the activity at the Requested RTO.

BIA – Other Dependency

Requested RTO This is the amount of time the BIA Owner or Contributor has requested this item be restored in able to resume their activity.
Suggested Recovery Time This is based on the Requested RTO for a linked activity. This shows the lowest RTO of all selected activities.

 

Applications

Lowest Requested RTO(uneditable) This is based on the Requested RTO for an Application through the BIA – Application Dependency section. This shows the lowest RTO of all BIAs declaring the application as a dependency.
Committed RTO* This is the amount of time this application can be down without creating additional impact.
This is pulled into IT Infrastructure through the Lowest Committed RTO field.
Proven RTO* This is the amount time, through exercises or incidents, that the application has proven to be able to reach recovery.
Lowest Requested RPO(uneditable) This is based on the Data Loss Tolerance for an Application through the BIA – Application Dependency section. This shows the lowest RPO of all BIAs declaring the application as a dependency.
Committed RPO* This is the amount of time this data loss that can be accepted without creating additional impact.
This is pulled into IT Infrastructure through the Lowest Committed RPO field.
Proven RPO* This is the amount data loss, through exercises or incidents, that the application has proven to be able to mitigate.

* Restricted fields that are only available for users with the Account Owner Role.

 

IT Infrastructure

Lowest Committed RTO(uneditable) This is based on the Application Committed RTO for applications that list this item as a dependency. This shows the lowest Committed RTO of all Applications depending on this item.
Committed RTO* This is the amount of time this item can be down without creating additional impact.
Proven RTO* This is the amount time, through exercises or incidents, that this item has proven to be able to reach recovery.
Lowest Committed RPO(uneditable) This is based on the Application Committed RPO for applications that list this item as a dependency. This shows the lowest Committed RPO of all Applications depending on this item.
Committed RPO* This is the amount of data loss that can be accepted without creating additional impact.
Proven RPO* This is the amount data loss, through exercises or incidents, that has proven to be mitigated.

* Restricted fields that are only available for users with ITDR Team or Account Owner Role.

Have more questions? Submit a request

Comments