In many business continuity programs, there are known and established Recovery Time Objectives (RTO) for business processes and for IT applications. More times than not, these RTOs are static and the response and recovery programs are built around these numbers as they came out of a Business Impact Analyses (or were merely assigned based on an educated guess).
I just wonder if it is reasonable to assume that recovery priorities remain the same throughout time. And I am not necessarily questioning whether they remain the same over time – but are they the same at different points in time throughout the business year or business cycle?
For example, is it reasonable to assume that our recovery priorities, or RTOs, might be different if the disaster occurred at month end or at year end as opposed to some other time in the year? Might our recovery priorities be different if we are in the middle of launching a new campaign or product or service?
And, could the disaster itself influence our recovery priorities? Could RTOs be different if we experience a data center only disaster versus a disaster that also impacted our workforce? Could our recovery priorities be different for a single-site disaster versus a multiple site disaster? Could we have different RTOs if we knew that the downtime was going to be hours or days versus weeks or months?
Now, I hate to over-complicate things in the planning process. I am always warning folks to avoid paralysis by analysis in the planning process, but I think these are legitimate questions to pose to mature and solid programs that are looking to continue to improve and strengthen their recovery posture.
This is also why I think it is important for your recovery program to include a well thought out and implemented Crisis Management component that gets the right decision makers together and empowers and enables them to make changes to the recovery process as the situation, at that time, dictates. So, maybe we maintain our single RTO, but we have the infrastructure in place that can accommodate changes in our recovery priority if and when needed.
Just something for the experienced planners to thing about and challenge their teams to consider in the maintenance and improvement process.