Highly available cloud services reduce the chance of infrastructure downtime. They do not cover every situation in which organizational data is deleted, overwritten, or encrypted.
The backup question should not end with “Do we have a copy?” Ask what can be recovered, who owns the recovery, how long it takes, and when the process was last tested.
RPO and RTO in business language
- RPO is the amount of recent data the business can afford to lose when returning to an earlier recovery point.
- RTO is how long the business can wait before a critical system or dataset must be available again.
IT should not set these numbers alone. Sales, finance, customer service, and operations face different impacts.
Testing is part of the plan
An untested recovery plan still carries uncertainty around access, recovery order, ownership, and incident communication. Start with one important process and simulate what the team would do if its data disappeared today.