A thorough application rationalization and dependency-mapping effort must always precede conversations about recovery of IT infrastructure. Technologists and application owners must perform a business impact analysis to determine each application’s criticality to business operations and to prioritize application recovery if a major service disruption were to occur. As part of this analysis, business owners of the services must define their recovery time objective (RTO) and recovery point objective (RPO).

• RTO—The amount of time that is required to completely restore a business capability to normal operations after a disaster has occurred. The organization would only be able to tolerate the degradation of a service or process for this period before the degradation causes serious consequences.
• RPO—The amount of data loss that an application can sustain after a major service outage before causing an unwanted impact on the business. RPO is also measured in time because it is the point in time from which the data must be recovered. RPO focuses on the data or transactions of an IT system.