Have ever struggled with Recovery Time Objectives? Is you have, you are not alone. Let’s face it, the struggle of setting reliable Recovery Time Objectives is real and we see it everywhere.
The typical methodology for achieving RTO’s is not objective at all and often relies heavily on business managers that want their own processes to be seen as important. How can that possibly be objective? In some cases this also causes companies to stretch already thin disaster recovery budgets by delivering backups for processes that do not really need it.
When it comes to setting RTO’s we should be looking heavily at the processes themselves. Determining criticality of processes should be more than just asking a manager or Business Process Owner (BPO) – how important is this process to you, is it critical, important or non-essential (or any other measure that you use), how quickly do you need this process and its applications up and running (in hours, days, etc.)? I’m not saying that managers are always wrong, many get it right, however, bias is easily inserted and the idea is to remain objective, right?
So how do we achieve objectivity with our RTO’s and processes? We ask objective questions.
Let’s get objective:
- Does this process contribute to, or support revenue?
- If so, what is that revenue on an hourly, daily basis?
- If not, is this process tied to any SLA agreements with any of our customers?
- If so, what do we stand to lose if those SLA’s are not met?
- Would we face any fines or regulatory issues if this process is not available? (eg. payroll does not contribute to revenue, but can produce steep fines for errors and missed deadlines)
This is not meant to be an exhaustive list, but a good starting point.
The recent calls to recover ASAP (As Soon As Possible) or AQAP (As Quickly As Possible) are also not objective and a bad idea. This leads to laziness and lackadaisical attitudes quite easily. Also, when responding to your CEO, CFO, auditors, or even regulatory body inquiries which sound better to the question – After a disruption or disaster how quickly will this process be up and running? As Quickly As Possible, or We can have that process up and running in 2 hours and we’ve tested it. Anyway, I’d love to see the look on your auditors face when you tell him AQAP, especially in the Finance Industry.
If you still need assistance or still struggle to set RTO’s or determine the value of your Business Continuity Program you might want to look at our Financial Impact Analysis Course which will teach you how to prove the Value of your Continuity program, Set better RTO’s and more.