Department/System: [Insert Title Here]

Purpose: This is a worksheet that should be completed by the Application Owner in order to identify the information needed to recover and continue operations during and following an emergency, incident, or disaster and identify mitigation actions to reduce loss.

In particular, The Application Owner is asked to identify the RPO (Recovery Point Objective) and RTO (Recovery Time Objective) of their application:

• RPO is primarily related to data integrity and the ability to restore data to a specific point in time. In other words, how long an application can run before needing to be backed up. Most applications have an RPO of 24 hours due to daily backups performed by the Windows or Linux teams. If your application has an RPO shorter than 24 hours, please indicate so and explain why.
• RTO is related to business continuity and the ability to resume operation quickly after a disruption. It is how long an application can be down before its lack of functionality creates significant adverse effects. Please identify the qualitative and quantitative impacts of losing your application and determine a justified RTO.

Please consider the following aspects of your application when filling out this form:

Timing	Duration (RPO)
Identify the points in time when interruption would have the greatest impact (e.g. season, end of month/quarter, etc.).	Identify how long it will take before qualitative and/or quantitative impacts will occur (e.g. < 1 hour, > 1 hour, < 8 hours, > 8 hours, > 24 hours, > 72 hours, > 168 hours, etc.)
Qualitative Impacts	Quantitative Impacts
Regulatory/Compliance issues Damage to Reputation Embarrassment Loss of research data Disruption of teaching or research Loss of faculty, staff, or students Well-being of faculty, staff, or students Legal obligations unmet by campus Legal harm to the university Impact on other campus unit(s) Impact on important partner(s)	Reduced productivity Increased expenses Delayed collection of Funds Reduced income revenues Breach of contract Lateness Penalties Loss of future business Loss of research funding Payment deadlines unmet Loss of revenue to campus

 

Timing	Duration (Hours)	Qualitative Impacts (Operation)	Quantitative Impacts (Financial)

 

Calculating the Recovery Time Objective (RTO) involves analyzing the qualitative and quantitative impacts of a potential disaster and determining the acceptable downtime for your systems and applications.

Here's a step-by-step process to calculate the RTO from the provided list of impacts:

Step 1: Determine the maximum financial loss tolerable from the application. Contact your financial analyst and discuss with them what loss is tolerable before there would be significant ramifications.

Step 2: Compile Qualitative and Quantitative Impacts. Review the list of qualitative and quantitative impacts and assign a daily financial value to each impact.

Step 3: Calculate Recover Time Objective. Sum the values of each impact in Step 2. Divide this value by the maximum loss tolerable determined in Step 1. The resulting number is the RTO.

For example, if the maximum financial loss tolerable was set to $30,000 and the daily financial value of all the qualitative and quantitative impacts was determined to be $1,500, the formula would be 30,000 / 1500 = 20 days. The recovery time objective would be 20 days, which means the application could be down for 20 days before unacceptable financial ramifications would occur.

RPO of application (most likely 24 hours)	RTO of Application