Data Recovery

Business Impact Analysis

Necessary functions are identified using a business impact analysis (BIA) or a similar tool for nonbusiness purposes. The BIA lists the functions performed and prioritizes them in order of most important to least important. Another determination is the RTO for each function; usually, the more important the function, the shorter the RTO. Then the RPO is determined by understanding the maximum age of the data that must be recovered. At times, functions cannot continue if they must start again with recovered data that are too old. This also helps determine the backup and restoration processes that must be used. Typically, the shorter the RTO and smaller the RPO, the more expensive data recovery will be.

Along with the BIA are financials that state the various costs of all functions not working. Quantifying how much revenue will be lost or how much cost will be incurred while waiting for the data to be recovered helps tell how much to spend on the data recovery processes. Typically, the higher priority a function has, the more it will cost in revenue or other costs to be without the function. Conversely, functions with a low priority typically don't garner much revenue or cost much to be without for extended periods of time. Of course, when this information is presented, it is up to the highest-level decision makers to determine how much they are willing to spend on data recovery to mitigate the identified costs. With an approved spending threshold, the data recovery processes can be determined. At times, the data cannot be recovered within the approved spend threshold. If that happens, the decision makers must decide whether they want longer RTO and RPO to avoid the cost of data recovery or provide additional funding to accomplish proper data recovery.

Armed with the entire set of requirements and objectives from the BIA and the spending threshold, the data recovery processes can be designed. The first part to design is the data backup. Longer RTOs and RPOs allow less expensive backup and recovery designs, while shorter RTOs and RPOs require more expensive backup and recovery designs. The data must be backed up in a format that can be recovered according to the RTOs and RPOs.

...