IT contingency planning: RTO, RPO and disaster recovery

In short: Contingency planning defines how quickly systems must run again (RTO) and how much data loss is tolerable (RPO), and describes steps, responsibilities and tests for an emergency.

In more detail: Failures are not a question of if but when: hardware defect, ransomware, fire, power outage, operator error, cloud outage. Business continuity (BCM) keeps operations running, disaster recovery (DR) restores IT.

In Depth

Key figures

• RTO (recovery time objective): maximum tolerable downtime (e.g. 4 hours).
• RPO (recovery point objective): maximum tolerable data loss in time (e.g. 15 minutes → backup/replication at least every 15 min).
• MTTR/MTBF: mean time to repair/between failures.
• Availability: 99 % ≈ 3.65 days/year downtime, 99.9 % ≈ 8.8 h, 99.99 % ≈ 53 min.
• Business impact analysis (BIA): which processes/systems are critical, what does an outage cost per hour?

Building blocks

• Backups per 3-2-1 rule + offline/immutable (ransomware), test restores regularly (a backup without a test is none).
• Redundancy: RAID, second network line, UPS, cluster, failover.
• Location: second site/cloud, hot/warm/cold standby.
• Contingency manual: contacts (also offline/printed), priorities, restart order (DNS/AD/network → database → applications), credentials stored safely, licence keys, network plans.
• Communication: who informs customers/authorities (reporting duties for data breaches, 72 h)?
• Roles: crisis team, deputies.

Emergency and exercise

Procedure: detect → assess → contain (disconnect network) → restore (from clean backup, rebuild non-infected systems) → verify → follow up (lessons learned). Exercises: tabletop scenarios (“What to do if the server burns?”), restore test, failover test. Keep documentation current and train those responsible. Ransomware: paying is not a plan, offline backups, segmentation, emergency contacts (police/BSI).

For small businesses and home projects

• Data: automatic backup to external disk + cloud/second location; test restore once a quarter.
• Documented credentials (password manager with emergency access).
• Business/shop: how long may the shop be down? Payment/shipping processes without the system?
• Paper emergency list: most important phone numbers, provider hotlines.
• Consider cyber insurance.
• Exam (IHK): explain RTO/RPO, calculate availability, assign measures.

See also: Backup strategy, UPS, Ransomware, ISO 27001 and BSI baseline protection