Recovery Point Objective (RPO)
The recovery point objective is the maximum amount of data, measured in time, that a business function or supporting ICT system can afford to lose after a disruption before the loss becomes unacceptable. Under DORA, financial entities set an RPO for each function alongside its recovery time objective (RTO) as part of the backup, restoration, and recovery procedures required by Article 12.
Detailed explanation
RPO answers a different question from RTO: not how long a service can stay down, but how much data created or changed since the last usable backup can be lost without causing unacceptable harm. An RPO of four hours means that, after a successful restoration, the entity can tolerate losing at most four hours' worth of transactions or records; it says nothing about how long the restoration itself takes, which is what RTO covers. Article 12 requires entities to set both objectives for each function, taking into account whether it is a critical or important function and the potential overall impact on market efficiency, and to back that choice with backup policies and procedures that specify the scope of data backed up and the minimum backup frequency based on the data's criticality or confidentiality. A tight RPO is only credible if the backup frequency and the restoration procedure can actually deliver it: backing up nightly cannot support a one-hour RPO, whatever the policy document claims. For entities other than microenterprises, Article 12 also expects restoration to run on ICT systems that are physically and logically segregated from the source system, so that whatever caused the original data loss, such as a ransomware encryption event, cannot also corrupt the backup used to meet the RPO. As with RTO, RPO commitments that depend on an ICT third-party provider's own backup and restoration capability should be reflected in that provider's contract and tested, not assumed, since DORA treats an unverified recovery promise from a provider the same way it treats an untested one in-house.
In context
This term relates to the ICT Risk Management pillar and is grounded in DORA Article 12.