BlackBox Hosting CEO Details RPO and RTO Testing Realities for DR

Matthew Burden, CEO of BlackBox Hosting, clarified the operational differences between recovery point objective and recovery time objective in a recent report by Help Net Security. These metrics define the boundaries of acceptable data loss and system downtime for organizations planning their disaster recovery strategies.

What is the difference between RPO and RTO?

Recovery point objective measures the maximum amount of data an organization can afford to lose, expressed as a time interval. Recovery time objective defines the longest period a business can remain offline during a restoration process. Burden noted that having backups does not ensure a rapid return to service, nor does a fast recovery timeline help if the restored data is outdated.

How should organizations validate these targets?

Burden stated that every application requires its own specific targets, and a theoretical four-hour recovery time is meaningless without practical verification. He recommended conducting tests every quarter rather than once a year. This frequency ensures that the defined recovery time objective remains achievable and that the infrastructure can actually support the required speed of restoration.

What does a high-performance recovery look like?

Burden shared a customer example involving more than 1,200 virtual machines. This environment maintained a contractual recovery point objective of one second and a recovery time objective of four hours. Data replicates between two data centers, and standby hardware remains ready. During quarterly tests, the environment started in approximately 90 minutes, well within the agreed timeframe.

Why does testing frequency matter for operations?

Setting targets based on business needs is only the first step. Burden emphasized that these targets must be tested often to remain valid. A backup strategy that has not been verified recently may fail when needed, leaving the organization exposed to prolonged downtime or significant data gaps that exceed their risk tolerance.

Questions to ask your suppliers

Teams should verify whether vendors can meet stated recovery time and point objectives during actual failure scenarios. Ask if their testing includes full environment restoration or just component checks. Ensure contract terms specify penalties for missed targets. Internal stakeholders, including IT leadership and compliance officers, need visibility into these agreements. Regular reviews of service level agreements help align vendor capabilities with organizational risk tolerance and business continuity requirements.

Background: Disaster recovery plans

Disaster recovery plans provide a structured method to restore systems after catastrophic failure. They reduce downtime and ensure business continuity. However, they do not stop attacks, require significant testing, and may fail if backups are compromised. Success depends on regular validation and air-gapped storage.

Read the full guide: Disaster Recovery Plans: Benefits, Limits, and When to Build One

What to do and how to stay safe: BlackBox Hosting

• Review current disaster recovery plans to ensure recovery time and point objectives are defined for every critical application.
• Schedule quarterly tests to validate that backup systems can restore data within the agreed timeframes.
• Verify that standby hardware and replication mechanisms are functional and ready for immediate use.
• Align recovery targets with actual business needs rather than assuming default settings are sufficient.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the difference between RPO and RTO?

RPO is the maximum acceptable data loss measured in time, while RTO is the maximum allowable downtime for recovery.

How often should organizations test their disaster recovery plans?

Matthew Burden suggests testing each quarter rather than once a year to ensure targets are met.

Can backups guarantee quick recovery?

No, Burden states that a backup does not guarantee quick recovery, and quick recovery helps little if data is old.